forked from GoogleCloudPlatform/policy-library
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathgcp_vpc_sc_ip_range_v1.yaml
84 lines (72 loc) · 3.16 KB
/
gcp_vpc_sc_ip_range_v1.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
apiVersion: templates.gatekeeper.sh/v1alpha1
kind: ConstraintTemplate
metadata:
name: gcp-vpc-sc-ip-range-v1
spec:
crd:
spec:
names:
kind: GCPVPCSCIPRangeConstraintV1
validation:
openAPIV3Schema:
properties:
maximum_cidr_size:
type: integer
description: "Maximum size in CIDR notation for an IP network"
#minimum: 0
#maximum: 32
targets:
validation.gcp.forsetisecurity.org:
rego: | #INLINE("validator/vpc_sc_ip_range.rego")
#
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
package templates.gcp.GCPVPCSCIPRangeConstraintV1
import data.validator.gcp.lib as lib
deny[{
"msg": message,
"details": metadata,
}] {
constraint := input.constraint
asset := input.asset
asset.asset_type == "cloudresourcemanager.googleapis.com/Organization"
lib.has_field(asset, "access_level")
conditions := asset.access_level.basic.conditions
condition := conditions[_]
count(lib.get_default(condition, "ip_subnetworks", [])) > 0
lib.get_constraint_params(constraint, params)
ip_network := condition.ip_subnetworks[_]
ip_network_parts := split(ip_network, "/")
ip_network_size := to_number(ip_network_parts[1])
maximum_size := params.maximum_cidr_size
maximum_size > ip_network_size
message := sprintf("IP range %v too broad in access level %v.", [ip_network, asset.access_level.name])
metadata := {"resource": asset.name, "access_level": asset.access_level.name}
}
#ENDINLINE