github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/internal/adapters/cloudformation/aws/ec2/instance.go (about)

     1  package ec2
     2  
     3  import (
     4  	"github.com/khulnasoft-lab/defsec/pkg/providers/aws/ec2"
     5  	"github.com/khulnasoft-lab/defsec/pkg/scanners/cloudformation/parser"
     6  	defsecTypes "github.com/khulnasoft-lab/defsec/pkg/types"
     7  )
     8  
     9  func getInstances(ctx parser.FileContext) (instances []ec2.Instance) {
    10  
    11  	instanceResources := ctx.GetResourcesByType("AWS::EC2::Instance")
    12  
    13  	for _, r := range instanceResources {
    14  		instance := ec2.Instance{
    15  			Metadata: r.Metadata(),
    16  			// metadata not supported by CloudFormation at the moment -
    17  			// https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/655
    18  			MetadataOptions: ec2.MetadataOptions{
    19  				Metadata:     r.Metadata(),
    20  				HttpTokens:   defsecTypes.StringDefault("optional", r.Metadata()),
    21  				HttpEndpoint: defsecTypes.StringDefault("enabled", r.Metadata()),
    22  			},
    23  			UserData:        r.GetStringProperty("UserData"),
    24  			SecurityGroups:  nil,
    25  			RootBlockDevice: nil,
    26  			EBSBlockDevices: nil,
    27  		}
    28  		blockDevices := getBlockDevices(r)
    29  		for i, device := range blockDevices {
    30  			copyDevice := device
    31  			if i == 0 {
    32  				instance.RootBlockDevice = copyDevice
    33  				continue
    34  			}
    35  			instance.EBSBlockDevices = append(instance.EBSBlockDevices, device)
    36  		}
    37  		instances = append(instances, instance)
    38  	}
    39  
    40  	return instances
    41  }
    42  
    43  func getBlockDevices(r *parser.Resource) []*ec2.BlockDevice {
    44  	var blockDevices []*ec2.BlockDevice
    45  
    46  	devicesProp := r.GetProperty("BlockDeviceMappings")
    47  
    48  	if devicesProp.IsNil() {
    49  		return blockDevices
    50  	}
    51  
    52  	for _, d := range devicesProp.AsList() {
    53  		encrypted := d.GetProperty("Ebs.Encrypted")
    54  		var result defsecTypes.BoolValue
    55  		if encrypted.IsNil() {
    56  			result = defsecTypes.BoolDefault(false, d.Metadata())
    57  		} else {
    58  			result = encrypted.AsBoolValue()
    59  		}
    60  
    61  		device := &ec2.BlockDevice{
    62  			Metadata:  d.Metadata(),
    63  			Encrypted: result,
    64  		}
    65  
    66  		blockDevices = append(blockDevices, device)
    67  	}
    68  
    69  	return blockDevices
    70  }