feat(CG-1293): update the rule checker

Author: james-zhou-inspire11

src/gcp/cis-1.3.0/rules/gcp-cis-1.3.0-1.16.ts

@@ -78,15 +78,20 @@ export default {
       email
     }
   }`,
-  resource: 'querygcpEssentialContact[1]',
+  resource: 'querygcpProject[*]',
   severity: 'unknown',
 
-  check: ({ data }: any): boolean => {
+  check: ({ resource }: any): boolean => {
+    const { essentialContacts } = resource
+    
+    if (!essentialContacts || essentialContacts.length === 0) {
+      return false
+    }
+
     const requiredCategories = ['LEGAL', 'SECURITY', 'SUSPENSION', 'TECHNICAL', 'TECHNICAL_INCIDENTS']
     const categoryAll = 'ALL'
 
-    const subscribedCategories = data.querygcpEssentialContact
-      .filter((obj: any) => !('@' in obj))
+    const subscribedCategories = essentialContacts
       .flatMap(({notificationCategorySubscriptions}: any) => notificationCategorySubscriptions)
 
     const result = requiredCategories.every((category: any) => subscribedCategories.includes(category))

src/gcp/cis-1.3.0/tests/gcp-cis-1.3.0-1.x.test.ts

@@ -32,6 +32,11 @@ export interface IamPolicy {
 export interface ApiKey {
   id: string
 }
+export interface EssentialContact {
+  id: string
+  notificationCategorySubscriptions: string[]
+  email: string
+}
 export interface Folder {
   iamPolicies: IamPolicy[]
 }
@@ -82,6 +87,7 @@ export interface QuerygcpProject {
   id: string
   iamPolicies?: IamPolicy[]
   apiKeys?: ApiKey[]
+  essentialContacts?: EssentialContact[]
 }
 
 export interface QuerygcpServiceAccount {
@@ -105,19 +111,13 @@ export interface QuerygcpIamPolicy {
   bindings: Bindings[]
 }
 
-export interface QuerygcpEssentialContact {
-  id: string
-  notificationCategorySubscriptions: string[]
-  email: string
-}
 export interface CIS1xQueryResponse {
   querygcpOrganization?: QuerygcpOrganization[]
   querygcpProject?: QuerygcpProject[]
   querygcpApiKey?: QuerygcpApiKey[]
   querygcpServiceAccount?: QuerygcpServiceAccount[]
   querygcpKmsKeyRing?: QuerygcpKmsKeyRing[]
   querygcpIamPolicy?: QuerygcpIamPolicy[]
-  querygcpEssentialContact?: QuerygcpEssentialContact[]
 }
 
 describe('CIS Google Cloud Platform Foundations: 1.3.0', () => {
@@ -905,56 +905,84 @@ describe('CIS Google Cloud Platform Foundations: 1.3.0', () => {
       expect(processedRule.result).toBe(expectedResult)
     }
 
-    test('Emails subscribed all required categories', async () => {
+    test('No Security Issue when Emails subscribed all required categories', async () => {
       const data: CIS1xQueryResponse = {
-        querygcpEssentialContact: [
-          {
-            id: cuid(),
-            notificationCategorySubscriptions: ['LEGAL', 'TECHNICAL', 'SUSPENSION', 'SECURITY'],
-            email: 'a@gmail.com'
-          },
+        querygcpProject: [
           {
             id: cuid(),
-            notificationCategorySubscriptions: ['TECHNICAL_INCIDENTS', 'SECURITY', 'BILLING'],
-            email: 'b@gmail.com'
+            essentialContacts: [
+              {
+                id: cuid(),
+                notificationCategorySubscriptions: ['LEGAL', 'TECHNICAL', 'SUSPENSION', 'SECURITY'],
+                email: 'a@gmail.com'
+              },
+              {
+                id: cuid(),
+                notificationCategorySubscriptions: ['TECHNICAL_INCIDENTS', 'SECURITY', 'BILLING'],
+                email: 'b@gmail.com'
+              },
+            ],
           },
         ],
       }
       await testRule(data, Result.PASS)
     })
-    test('Emails missed one required subscription category', async () => {
+    test('Security Issue when Emails missed one required subscription category', async () => {
       const data: CIS1xQueryResponse = {
-        querygcpEssentialContact: [
-          {
-            id: cuid(),
-            notificationCategorySubscriptions: ['LEGAL', 'SUSPENSION', 'SECURITY'],
-            email: 'a@gmail.com'
-          },
-          {
-            id: cuid(),
-            notificationCategorySubscriptions: ['TECHNICAL_INCIDENTS', 'SECURITY', 'BILLING'],
-            email: 'b@gmail.com'
-          },
-        ],
+        querygcpProject: [{
+          id: cuid(),
+          essentialContacts: [
+            {
+              id: cuid(),
+              notificationCategorySubscriptions: ['LEGAL', 'SUSPENSION', 'SECURITY'],
+              email: 'a@gmail.com'
+            },
+            {
+              id: cuid(),
+              notificationCategorySubscriptions: ['TECHNICAL_INCIDENTS', 'SECURITY', 'BILLING'],
+              email: 'b@gmail.com'
+            },
+          ],
+        }]
       }
       await testRule(data, Result.FAIL)
     })
-    test('An email subscribed ALL category', async () => {
+    test('No Security Issue when an email subscribed ALL category', async () => {
       const data: CIS1xQueryResponse = {
-        querygcpEssentialContact: [
-          {
-            id: cuid(),
-            notificationCategorySubscriptions: ['LEGAL', 'TECHNICAL', 'SUSPENSION', 'SECURITY'],
-            email: 'a@gmail.com'
-          },
-          {
-            id: cuid(),
-            notificationCategorySubscriptions: ['ALL'],
-            email: 'b@gmail.com'
-          },
-        ],
+        querygcpProject: [{
+          id: cuid(),
+          essentialContacts: [
+            {
+              id: cuid(),
+              notificationCategorySubscriptions: ['LEGAL', 'TECHNICAL', 'SUSPENSION', 'SECURITY'],
+              email: 'a@gmail.com'
+            },
+            {
+              id: cuid(),
+              notificationCategorySubscriptions: ['ALL'],
+              email: 'b@gmail.com'
+            },
+          ],
+        }]
       }
       await testRule(data, Result.PASS)
     })
+    test('Security Issue when Essential contact API is not enabled', async () => {
+      const data: CIS1xQueryResponse = {
+        querygcpProject: [{
+          id: cuid(),
+        }]
+      }
+      await testRule(data, Result.FAIL)
+    })
+    test('Security Issue when Essential contact is either not configured', async () => {
+      const data: CIS1xQueryResponse = {
+        querygcpProject: [{
+          id: cuid(),
+          essentialContacts: [],
+        }]
+      }
+      await testRule(data, Result.FAIL)
+    })
   })
 })