Update PaC examples for latest API
Updates for the changes to no longer use the "output" shape of the resource (instead we're using the "input" shape, i.e. the resource's args type).
MODIFY
policy-packs/aws-advanced/compute.ts
policy-packs/aws-advanced/compute.ts
@@ -31,17 +31,17 @@ export function requireApprovedAmisById(
description: "Instances should use approved AMIs.",
enforcementLevel: "mandatory",
validateResource: [
- validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
+ validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
if (amis && !amis.has(instance.ami)) {
reportViolation("EC2 Instances should use approved AMIs.");
}
}),
- validateTypedResource(aws.ec2.LaunchConfiguration.isInstance, (lc, args, reportViolation) => {
+ validateTypedResource(aws.ec2.LaunchConfiguration, (lc, args, reportViolation) => {
if (amis && !amis.has(lc.imageId)) {
reportViolation("EC2 LaunchConfigurations should use approved AMIs.");
}
}),
- validateTypedResource(aws.ec2.LaunchTemplate.isInstance, (lt, args, reportViolation) => {
+ validateTypedResource(aws.ec2.LaunchTemplate, (lt, args, reportViolation) => {
if (amis && lt.imageId && !amis.has(lt.imageId)) {
reportViolation("EC2 LaunchTemplates should use approved AMIs.");
}
@@ -60,12 +60,13 @@ export function requireHealthChecksOnAsgElb(name: string): ResourceValidationPol
"Auto Scaling groups that are associated with a load balancer should use Elastic " +
"Load Balancing health checks",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.autoscaling.Group.isInstance, (group, args, reportViolation) => {
- const classicLbAttached = group.loadBalancers.length > 0;
- const albAttached = group.targetGroupArns.length > 0;
+ validateResource: validateTypedResource(aws.autoscaling.Group, (group, args, reportViolation) => {
+ const classicLbAttached = group.loadBalancers && group.loadBalancers.length > 0;
+ const albAttached = group.targetGroupArns && group.targetGroupArns.length > 0;
if (classicLbAttached || albAttached) {
if (group.healthCheckType !== "ELB") {
- reportViolation("Auto Scaling groups that are associated with a load balancer should use");
+ reportViolation("Auto Scaling groups that are associated with a load balancer should use Elastic " +
+ "Load Balancing health checks");
}
}
}),
@@ -88,8 +89,8 @@ export function requireInstanceTenancy(
)} should use tenancy '${tenancy}'`,
enforcementLevel: "mandatory",
validateResource: [
- validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
- if (hosts !== undefined && hosts.has(instance.hostId)) {
+ validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
+ if (hosts !== undefined && instance.hostId && hosts.has(instance.hostId)) {
if (instance.tenancy !== tenancy) {
reportViolation(`EC2 Instance with host ID '${instance.hostId}' not using tenancy '${tenancy}'.`);
}
@@ -99,7 +100,7 @@ export function requireInstanceTenancy(
}
}
}),
- validateTypedResource(aws.ec2.LaunchConfiguration.isInstance, (lc, args, reportViolation) => {
+ validateTypedResource(aws.ec2.LaunchConfiguration, (lc, args, reportViolation) => {
if (images !== undefined && images.has(lc.imageId)) {
if (lc.placementTenancy !== tenancy) {
reportViolation(`EC2 LaunchConfiguration with image ID '${lc.imageId}' not using tenancy '${tenancy}'.`);
@@ -121,17 +122,17 @@ export function requireInstanceType(
description: "EC2 instances should use approved instance types.",
enforcementLevel: "mandatory",
validateResource: [
- validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
+ validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
if (!types.has(instance.instanceType)) {
reportViolation("EC2 Instance should use the approved instance types.")
}
}),
- validateTypedResource(aws.ec2.LaunchConfiguration.isInstance, (lc, args, reportViolation) => {
+ validateTypedResource(aws.ec2.LaunchConfiguration, (lc, args, reportViolation) => {
if (!types.has(lc.instanceType)) {
reportViolation("EC2 LaunchConfiguration should use the approved instance types.")
}
}),
- validateTypedResource(aws.ec2.LaunchTemplate.isInstance, (lt, args, reportViolation) => {
+ validateTypedResource(aws.ec2.LaunchTemplate, (lt, args, reportViolation) => {
if (!lt.instanceType || !types.has(lt.instanceType)) {
reportViolation("EC2 LaunchTemplate should use the approved instance types.")
}
@@ -146,7 +147,7 @@ export function requireEbsOptimization(name: string): ResourceValidationPolicy {
name: name,
description: "EBS optimization should be enabled for all EC2 instances",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
+ validateResource: validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
if (instance.ebsOptimized !== true) {
reportViolation("EC2 Instance should have EBS optimization enabled.");
}
@@ -159,7 +160,7 @@ export function requireDetailedMonitoring(name: string): ResourceValidationPolic
name: name,
description: "Detailed monitoring should be enabled for all EC2 instances",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
+ validateResource: validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
if (instance.monitoring !== true) {
reportViolation("EC2 Instance should have monitoring enabled.");
}
@@ -197,7 +198,7 @@ export function requireEbsVolumesOnEc2Instances(name: string): ResourceValidatio
name: name,
description: "EBS volumes should be attached to all EC2 instances",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
+ validateResource: validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
if (instance.ebsBlockDevices !== undefined && instance.ebsBlockDevices.length === 0) {
reportViolation("EC2 Instance should have EBS volumes attached.");
}
@@ -213,7 +214,7 @@ export function requireEbsEncryption(name: string, kmsKeyId?: string): ResourceV
name: name,
description: "EBS volumes should be encrypted",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.ebs.Volume.isInstance, (volume, args, reportViolation) => {
+ validateResource: validateTypedResource(aws.ebs.Volume, (volume, args, reportViolation) => {
if (!volume.encrypted) {
reportViolation("EBS volumes should be encrypted.");
}
@@ -260,8 +261,8 @@ export function requireElbLogging(name: string, bucketName?: string): ResourceVa
"logging enabled.",
enforcementLevel: "mandatory",
validateResource: [
- validateTypedResource(aws.elasticloadbalancing.LoadBalancer.isInstance, assertElbLogs),
- validateTypedResource(aws.elasticloadbalancingv2.LoadBalancer.isInstance, assertElbLogs),
+ validateTypedResource(aws.elasticloadbalancing.LoadBalancer, assertElbLogs),
+ validateTypedResource(aws.elasticloadbalancingv2.LoadBalancer, assertElbLogs),
],
};
}

MODIFY
policy-packs/aws/index.ts
policy-packs/aws/index.ts
@@ -7,7 +7,7 @@ const policies = new PolicyPack("aws", {
name: "discouraged-ec2-public-ip-address",
description: "Associating public IP addresses is discouraged.",
enforcementLevel: "advisory",
- validateResource: validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
+ validateResource: validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
if (instance.associatePublicIpAddress) {
reportViolation("Consider not setting associatePublicIpAddress to true.");
}
@@ -18,10 +18,10 @@ const policies = new PolicyPack("aws", {
description: "A 'Name' tag is required.",
enforcementLevel: "mandatory",
validateResource: [
- validateTypedResource(aws.ec2.Instance.isInstance, (instance, args, reportViolation) => {
+ validateTypedResource(aws.ec2.Instance, (instance, args, reportViolation) => {
requireNameTag(instance.tags, reportViolation);
}),
- validateTypedResource(aws.ec2.Vpc.isInstance, (vpc, args, reportViolation) => {
+ validateTypedResource(aws.ec2.Vpc, (vpc, args, reportViolation) => {
requireNameTag(vpc.tags, reportViolation);
}),
],
@@ -30,8 +30,8 @@ const policies = new PolicyPack("aws", {
name: "prohibited-public-internet",
description: "Ingress rules with public internet access are prohibited.",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.ec2.SecurityGroup.isInstance, (sg, args, reportViolation) => {
- const publicInternetRules = sg.ingress.find(ingressRule =>
+ validateResource: validateTypedResource(aws.ec2.SecurityGroup, (sg, args, reportViolation) => {
+ const publicInternetRules = (sg.ingress || []).find(ingressRule =>
(ingressRule.cidrBlocks || []).find(cidr => cidr === "0.0.0.0/0"));
if (publicInternetRules) {
reportViolation("Ingress rules with public internet access are prohibited.");

MODIFY
policy-packs/azure/index.ts
policy-packs/azure/index.ts
import * as azure from "@pulumi/azure";
import { PolicyPack, validateTypedResource } from "@pulumi/policy";
-import * as assert from "assert";
const policies = new PolicyPack("azure", {
policies: [
@@ -8,7 +7,7 @@ const policies = new PolicyPack("azure", {
name: "discouraged-public-ip-address",
description: "Associating public IP addresses is discouraged.",
enforcementLevel: "advisory",
- validateResource: validateTypedResource(azure.network.NetworkInterface.isInstance, (ni, args, reportViolation) => {
+ validateResource: validateTypedResource(azure.network.NetworkInterface, (ni, args, reportViolation) => {
const publicIpAssociations = ni.ipConfigurations.find(cfg => cfg.publicIpAddressId !== undefined);
if (publicIpAssociations !== undefined) {
reportViolation("Associating public IP addresses is discouraged.");
@@ -19,7 +18,7 @@ const policies = new PolicyPack("azure", {
name: "prohibited-public-internet",
description: "Inbound rules with public internet access are prohibited.",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(azure.network.NetworkSecurityRule.isInstance, (securityRule, args, reportViolation) => {
+ validateResource: validateTypedResource(azure.network.NetworkSecurityRule, (securityRule, args, reportViolation) => {
if (securityRule.sourceAddressPrefix === "*") {
reportViolation("Inbound rules with public internet access are prohibited.");
}

MODIFY
policy-packs/gcp/index.ts
policy-packs/gcp/index.ts
@@ -7,7 +7,7 @@ const policies = new PolicyPack("gcp", {
name: "discouraged-gcp-public-ip-address",
description: "Associating public IP addresses is discouraged.",
enforcementLevel: "advisory",
- validateResource: validateTypedResource(gcp.compute.Instance.isInstance, (instance, args, reportViolation) => {
+ validateResource: validateTypedResource(gcp.compute.Instance, (instance, args, reportViolation) => {
const publicIps = instance.networkInterfaces.find(net => net.accessConfigs !== undefined);
if (publicIps !== undefined) {
reportViolation("Associating public IP addresses is discouraged.");
@@ -18,7 +18,7 @@ const policies = new PolicyPack("gcp", {
name: "prohibited-public-internet",
description: "Ingress rules with public internet access are prohibited.",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(gcp.compute.Firewall.isInstance, (firewall, args, reportViolation) => {
+ validateResource: validateTypedResource(gcp.compute.Firewall, (firewall, args, reportViolation) => {
const publicInternetRules = (firewall.sourceRanges || []).find(ranges => ranges === "0.0.0.0/0");
if (publicInternetRules !== undefined) {
reportViolation("Ingress rules with public internet access are prohibited.");

MODIFY
policy-packs/kubernetes/index.ts
policy-packs/kubernetes/index.ts
@@ -21,8 +21,8 @@ const policies = new PolicyPack("kubernetes", {
name: "no-public-services",
description: "Kubernetes Services should be cluster-private",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(k8s.core.v1.Service.isInstance, (svc, args, reportViolation) => {
- if (svc.spec.type == "LoadBalancer") {
+ validateResource: validateTypedResource(k8s.core.v1.Service, (svc, args, reportViolation) => {
+ if (svc.spec && svc.spec.type === "LoadBalancer") {
reportViolation(`Kubernetes Services that have .type === "LoadBalancer" are exposed to ` +
`anything that can reach the Kubernetes cluster, likely including the ` +
`public Internet. The security team has disallowed this to prevent ` +

MODIFY
policy-packs/policy-pack-typescript/index.ts
policy-packs/policy-pack-typescript/index.ts
@@ -20,7 +20,7 @@ new PolicyPack("policy-pack-typescript", {
name: "s3-no-public-read",
description: "Prohibits setting the publicRead or publicReadWrite permission on AWS S3 buckets.",
enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.s3.Bucket.isInstance, (bucket, args, reportViolation) => {
+ validateResource: validateTypedResource(aws.s3.Bucket, (bucket, args, reportViolation) => {
if (bucket.acl === "public-read" || bucket.acl === "public-read-write") {
reportViolation(
"You cannot set public-read or public-read-write on an S3 bucket. " +

Update PaC examples for latest API (#455)

Updates for the changes to no longer use the "output" shape of the resource (instead we're using the "input" shape, i.e. the resource's args type).