feat(query): implements "Beta - Cloud Asset Inventory Disabled" - Terraform/gcp

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/metadata.json

@@ -0,0 +1,14 @@
+{
+  "id": "4f60da73-190e-4048-8e1d-cc5a3974cd15",
+  "queryName": "Beta - Cloud Asset Inventory Disabled",
+  "severity": "MEDIUM",
+  "category": "Observability",
+  "descriptionText": "The 'google_project_service.service' field must include 'cloudasset.googleapis.com' to allow Cloud Asset Inventory",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_service#service-1",
+  "platform": "Terraform",
+  "descriptionID": "4f60da73",
+  "cloudProvider": "gcp",
+  "cwe": "778",
+  "riskScore": "3.0",
+  "experimental": "true"
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/query.rego

@@ -0,0 +1,51 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.terraform as tf_lib
+
+CxPolicy[result] {
+	resources := [ res | res := {"value" : input.document[index].resource["google_project_service"][name], "doc_index" : index, "name" : name}]
+
+	not at_least_one_asset_inventory_enabled(resources)
+
+	result := {
+		"documentId": input.document[resources[x].doc_index].id,
+		"resourceType": "google_project_service",
+		"resourceName": tf_lib.get_resource_name(resources[x].value, resources[x].name),
+		"searchKey": sprintf("google_project_service[%s].service", [resources[x].name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": "At least one 'google_project_service.service' field should contain or be equal to 'cloudasset.googleapis.com'",
+		"keyActualValue": "No 'google_project_service.service' field contains or is equal to 'cloudasset.googleapis.com'",
+		"searchLine": common_lib.build_search_line(["resource", "google_project_service", resources[x].name, "service"], [])
+	}
+}
+
+at_least_one_asset_inventory_enabled(resources) {
+	service_includes_cloudasset(resources[y].value.service, resources[y].value, input.document[resources[y].doc_index])
+}
+
+service_includes_cloudasset(service, project, doc) {
+	service == "cloudasset.googleapis.com"
+} else {
+	service == "${each.value}"
+	contains(project.for_each, "\"cloudasset.googleapis.com\"")
+} else {
+	service == "${each.value}"
+	project.for_each[_] == "cloudasset.googleapis.com"
+} else {
+	service == "${each.value}"
+	regex.match("local\\..+", project.for_each)
+
+	patterns := {"${local.": "" , "}":  "" }
+    local_name := strings.replace_n(patterns, project.for_each)   # extracts the variable name
+
+	contains_or_in_set(doc.locals[local_name])
+}
+
+contains_or_in_set(local_var) {
+	local_var == "cloudasset.googleapis.com"
+} else  {
+	local_var[_] == "cloudasset.googleapis.com"
+} else {
+	contains(local_var, "\"cloudasset.googleapis.com\"")
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/negative1.tf

@@ -0,0 +1,3 @@
+resource "google_project_service" "negative_1" {
+  service            = "cloudasset.googleapis.com"
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/negative2.tf

@@ -0,0 +1,8 @@
+resource "google_project_service" "negative_2" {
+  for_each = toset([
+    "compute.googleapis.com",
+    "cloudasset.googleapis.com",
+    "pubsub.googleapis.com",
+  ])
+  service            = each.value       # using for_each on a "toset"
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/negative3.tf

@@ -0,0 +1,7 @@
+resource "google_project_service" "negative_3" {
+  for_each = {
+    compute   = "compute.googleapis.com"
+    cloudasset = "cloudasset.googleapis.com"
+  }
+  service = each.value    # using for_each on a set
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/negative4.tf

@@ -0,0 +1,8 @@
+locals {
+  api = "cloudasset.googleapis.com"
+}
+
+resource "google_project_service" "negative_4" {
+  for_each = local.api              # using the "api" from "locals" variables
+  service  = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/negative5.tf

@@ -0,0 +1,12 @@
+locals {
+  apis_toset = toset([
+    "compute.googleapis.com",
+    "cloudasset.googleapis.com",
+    "pubsub.googleapis.com",
+  ])
+}
+
+resource "google_project_service" "negative_5" {
+  for_each = local.apis_toset         # using apis_toset from "locals" variables
+  service  = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/negative6.tf

@@ -0,0 +1,11 @@
+locals {
+  apis_set = {
+    compute   = "compute.googleapis.com"
+    cloudasset = "cloudasset.googleapis.com"
+  }
+}
+
+resource "google_project_service" "negative_6" {
+  for_each = local.apis_set         # using apis_set from "locals" variables
+  service  = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/positive1.tf

@@ -0,0 +1,7 @@
+resource "google_project_service" "positive1_1" {
+  service            = "not_cloudasset.googleapis.com"
+}
+
+resource "google_project_service" "positive1_2" {
+  service            = "not_cloudasset.googleapis.com_2"
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/positive2.tf

@@ -0,0 +1,7 @@
+resource "google_project_service" "positive_2" {
+  for_each = toset([
+    "compute.googleapis.com",
+    "pubsub.googleapis.com",
+  ])
+  service            = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/positive3.tf

@@ -0,0 +1,7 @@
+resource "google_project_service" "positive_3" {
+  for_each = {
+    compute   = "compute.googleapis.com"
+    pubsub    = "pubsub.googleapis.com"
+  }
+  service = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/positive4.tf

@@ -0,0 +1,8 @@
+locals {
+  api = "not_cloudasset.googleapis.com"
+}
+
+resource "google_project_service" "positive_4" {
+  for_each = local.api
+  service  = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/positive5.tf

@@ -0,0 +1,11 @@
+locals {
+  apis_toset = toset([
+    "compute.googleapis.com",
+    "pubsub.googleapis.com",
+  ])
+}
+
+resource "google_project_service" "positive_5" {
+  for_each = local.apis_toset
+  service  = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/positive6.tf

@@ -0,0 +1,11 @@
+locals {
+  apis_set = {
+    compute   = "compute.googleapis.com"
+    pubsub    = "pubsub.googleapis.com"
+  }
+}
+
+resource "google_project_service" "positive_6" {
+  for_each = local.apis_set
+  service  = each.value
+}

assets/queries/terraform/gcp/cloud_asset_inventory_disabled/test/positive_expected_result.json

@@ -0,0 +1,44 @@
+[
+  {
+    "queryName": "Beta - Cloud Asset Inventory Disabled",
+    "severity": "MEDIUM",
+    "line": 2,
+    "filename": "positive1.tf"
+  },
+  {
+    "queryName": "Beta - Cloud Asset Inventory Disabled",
+    "severity": "MEDIUM",
+    "line": 6,
+    "filename": "positive1.tf"
+  },
+  {
+    "queryName": "Beta - Cloud Asset Inventory Disabled",
+    "severity": "MEDIUM",
+    "line": 6,
+    "filename": "positive2.tf"
+  },
+  {
+    "queryName": "Beta - Cloud Asset Inventory Disabled",
+    "severity": "MEDIUM",
+    "line": 6,
+    "filename": "positive3.tf"
+  },
+  {
+    "queryName": "Beta - Cloud Asset Inventory Disabled",
+    "severity": "MEDIUM",
+    "line": 7,
+    "filename": "positive4.tf"
+  },
+  {
+    "queryName": "Beta - Cloud Asset Inventory Disabled",
+    "severity": "MEDIUM",
+    "line": 10,
+    "filename": "positive5.tf"
+  },
+  {
+    "queryName": "Beta - Cloud Asset Inventory Disabled",
+    "severity": "MEDIUM",
+    "line": 10,
+    "filename": "positive6.tf"
+  }
+]

assets/similarityID_transition/terraform_gcp.yaml

@@ -3,3 +3,7 @@ similarityIDChangeList:
       queryName: Beta - Google DNS Policy Logging Disabled
       observations: ""
       change: 2
+    - queryId: 4f60da73-190e-4048-8e1d-cc5a3974cd15
+      queryName: Beta - Cloud Asset Inventory Disabled
+      observations: ""
+      change: 2