How to create custom checks in tfsec - terraform

Question

I have the following policy that I wish to implement in my IaC code scan using tfsec:
Custom Check: GCP Firewall rule allows all traffic on Telnet port (23)
The below is my custom check in .json format:
{
"checks":
[
{
"code": "CUS003",
"description": "Custom Check: GCP Firewall rule allows all traffic on Telnet port (23)",
"requiredTypes":
[
"resource"
],
"requiredLabels":
[
"google_compute_firewall"
],
"severity": "WARNING",
"matchSpec":
{
"name": "CUS003_matchSpec_name",
"action": "and",
"predicateMatchSpec":
[
{
"name": "source_ranges",
"action": "contains",
"value": "0.0.0.0/0"
},
{
"name": "ports",
"action": "contains",
"value": "23"
}
]
},
"errorMessage": "[WARNING] GCP Firewall rule allows all traffic on Telnet port (23)",
"relatedLinks":
[
"https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall"
]
}
]
}
I have tried using "not", "notContains", "equals", a combination of "subMatch" and/or "predicateMatchSpec" but nothing worked.
To test it out I have purposefully created firewall rules that should fail and others that should pass the checks. When I get check failures, it's for all rules, not just a few ones. Similarly when I get check passes, it's for all rules, not just a few ones.
Docs that might be useful: tfsec custom checks
Any help is appreciated. Unfortunately "tfsec" isn't a tag so I am hoping it's a terraform issue that I am facing.

Answer 1

I think now looking at it formatted its clear that source_ranges is a child of the google_compute_firewall resource. The ports attribute is a child of the allow. Your check is assuming that ports is a sibling of source_ranges.
I think this check is achievable with the following - it does a predicate check that there is source_range as required AND there is a block called allow, with an attribute ports containing 23
{
"checks": [
{
"code": "CUS003",
"description": "Custom Check: GCP Firewall rule allows all traffic on Telnet port (23)",
"requiredTypes": [
"resource"
],
"requiredLabels": [
"google_compute_firewall"
],
"severity": "WARNING",
"matchSpec": {
"action": "and",
"predicateMatchSpec": [
{
"name": "source_ranges",
"action": "contains",
"value": "0.0.0.0/0"
},
{
"name": "allow",
"action": "isPresent",
"subMatch": {
"name": "ports",
"action": "contains",
"value": "23",
"ignoreUndefined": true
}
}
]
},
"errorMessage": "[WARNING] GCP Firewall rule allows all traffic on Telnet port (23)",
"relatedLinks": [
"https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall"
]
}
]
}
I've tested it against the following body
resource "google_compute_firewall" "default" {
name = "test-firewall"
network = google_compute_network.default.name
allow {
protocol = "tcp"
ports = ["23", "8080", "1000-2000"]
}
source_ranges = ["0.0.0.0/0"]
source_tags = ["web"]
}
resource "google_compute_network" "default" {
name = "test-network"
}