fix(aws): remove duplicate bucket logging rule

[nikpivkin]

We already have a bucket logging rule.

See aquasecurity/trivy#4975
Fixes aquasecurity/trivy#5004

[nikpivkin]

@simar7 The tests failed at the OPA install stage: sha256sum: checksum: no properly formatted SHA256 checksum lines found

[simar7]

I believe it's one of the existing Go rules that we've transformed into Rego. In this case we would want to remove the Go rule and keep the rego rule.

Does the rego rule scan the misconfiguration correctly?

[simar7]

These are the rules I moved into the rules/ dir recently 91898b5 do we have any other rules that also exist in Go that overlap with these? If so, we should remove them (Go rules).

[nikpivkin]

@simar7 OK, I'll return rego and remove the GO rule. By the way, the rego rule contained an invalid AVD ID.

[davidbmleach]

Is it possible this duplication also generates a false positive when you do something like this?:

# tfsec:ignore:aws-s3-enable-bucket-logging
# tfsec:ignore:aws-s3-enable-versioning
resource "aws_s3_bucket" "this" {
  bucket        = var.name
}

[nikpivkin]

Hi @davidbmleach

If this comment doesn't help you, could you describe in more detail what happened to you and what you expected to see?

[simar7]

We need to keep the examples (in Go) still available to us as they are used for doc generation. An example on how to use them is here https://github.com/aquasecurity/defsec/blob/master/rules/cloud/policies/aws/rds/disable_public_access.rego#L22-L25

[nikpivkin]

@simar7 The good_example field specifies the GO file, but the file also contains a bad example and links. How does it work?

[simar7]

@nikpivkin they are loaded like such

defsec/pkg/rego/metadata.go

Line 266 in 063dcd6

if val, ok := sMap["good_examples"].(string); ok {

[nikpivkin]

@simar7 I think I found a code that parses GO files to generate documentation.

I have a couple of questions:

• Why are only good examples generated for documentation, but not bad ones?
• If there are several good examples, then only 1 is generated
• Links in the metadata of the engine must be specified as values, not links to GO files, and it is impossible to specify multiple links:

#   terraform:
#       good_examples: "rules/cloud/policies/aws/s3/enable_bucket_logging.tf.go"
#       links: "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket"

[nikpivkin]

@simar7 By the way, the "RDS Publicly Accessible" rule is duplicated:

• rego https://github.com/aquasecurity/defsec/blob/master/rules/cloud/policies/aws/rds/disable_public_access.rego
• GO https://github.com/aquasecurity/defsec/blob/master/rules/cloud/policies/aws/rds/no_public_db_access.go

[simar7]

@simar7 By the way, the "RDS Publicly Accessible" rule is duplicated:

• rego https://github.com/aquasecurity/defsec/blob/master/rules/cloud/policies/aws/rds/disable_public_access.rego
• GO https://github.com/aquasecurity/defsec/blob/master/rules/cloud/policies/aws/rds/no_public_db_access.go

New issue aquasecurity/trivy#5065

[simar7]

@simar7 I think I found a code that parses GO files to generate documentation.

I have a couple of questions:

• Why are only good examples generated for documentation, but not bad ones?
• If there are several good examples, then only 1 is generated
• Links in the metadata of the engine must be specified as values, not links to GO files, and it is impossible to specify multiple links:

#   terraform:
#       good_examples: "rules/cloud/policies/aws/s3/enable_bucket_logging.tf.go"
#       links: "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket"

All of the above are improvements that we can add. The existing documentation at the time of implementing mostly had good examples than bad so support was added for them at first.

[simar7]

ditto for terraform example.

[simar7]

left comments

[nikpivkin]

@simar7 I updated the config for golangci-lint and added ignoring U1000 (unused variables) for variables in those files referenced from Rego. I noticed that now golangci-linter uses the following linters to check dead code: unused, struct check, deadcode and varcheck. All of them except unsuded are deprecated. How about updating the config?

[simar7]

@simar7 I updated the config for golangci-lint and added ignoring U1000 (unused variables) for variables in those files referenced from Rego. I noticed that now golangci-linter uses the following linters to check dead code: unused, struct check, deadcode and varcheck. All of them except unsuded are deprecated. How about updating the config?

Sounds good. Let's create a separate issue and track it there.