add check for unresolved variables

tenable · May 11, 2021 · 83533de · 83533de
1 parent 9ac1667
commit 83533de
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/pkg/policies/opa/rego/aws/aws_launch_configuration/hardCodedShellScript.rego b/pkg/policies/opa/rego/aws/aws_launch_configuration/hardCodedShellScript.rego
@@ -2,6 +2,7 @@ package accurics
 
 {{.prefix}}hardCodedShellScript[res.id]{
     res = input.aws_instance[_]
+    not startswith(res.config.user_data_base64, "$")
     value = base64NullCheck(res.config.user_data_base64)
     startswith(value, "#!/")
 }