feat(codebuild): codebuild service and checks (#1467)

providers/aws/services/codebuild/codebuild_project_user_controlled_buildspec/codebuild_project_user_controlled_buildspec.metadata.json

@@ -0,0 +1,35 @@
+{
+    "Provider": "aws",
+    "CheckID": "codebuild_project_user_controlled_buildspec",
+    "CheckTitle": "Ensure CodeBuild Project uses a controlled buildspec",
+    "CheckType": ["Software and Configuration Checks", "Industry and Regulatory Standards"],
+    "ServiceName": "codebuild",
+    "SubServiceName": "",
+    "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+    "Severity": "medium",
+    "ResourceType": "AwsCodeBuildProject",
+    "Description": "Ensure CodeBuild Project uses a controlled buildspec",
+    "Risk": "The CodeBuild projects with user controlled buildspec",
+    "RelatedUrl": "",
+    "Remediation": {
+      "Code": {
+        "CLI": "",
+        "NativeIaC": "",
+        "Other": "",
+        "Terraform": ""
+      },
+      "Recommendation": {
+        "Text": "Use buildspec.yml from a trusted source which user cant interfere with",
+        "Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/security.html"
+      }
+    },
+    "Categories": [],
+    "Tags": {
+      "Tag1Key": "value",
+      "Tag2Key": "value"
+    },
+    "DependsOn": [],
+    "RelatedTo": [],
+    "Notes": "",
+    "Compliance": []
+  }

providers/aws/services/codebuild/codebuild_project_user_controlled_buildspec/codebuild_project_user_controlled_buildspec.py

@@ -0,0 +1,26 @@
+from re import search
+
+from lib.check.models import Check, Check_Report
+from providers.aws.services.codebuild.codebuild_client import codebuild_client
+
+
+class codebuild_project_user_controlled_buildspec(Check):
+    def execute(self):
+        findings = []
+        for project in codebuild_client.projects:
+            report = Check_Report(self.metadata)
+            report.region = project.region
+            report.resource_id = project.name
+            report.resource_arn = ""
+            report.status = "FAIL"
+            report.status_extended = f"CodeBuild project {project.name} does not use a user controlled buildspec"
+            if project.buildspec:
+                if search(".*\.yaml$", project.buildspec) or search(
+                    ".*\.yml$", project.buildspec
+                ):
+                    report.status = "PASS"
+                    report.status_extended = f"CodeBuild project {project.name} uses a user controlled buildspec"
+
+            findings.append(report)
+
+        return findings

providers/aws/services/codebuild/codebuild_project_user_controlled_buildspec/codebuild_project_user_controlled_buildspec_test.py

@@ -0,0 +1,88 @@
+from re import search
+from unittest import mock
+
+from providers.aws.services.codebuild.codebuild_service import CodebuildProject
+
+
+class Test_codebuild_project_user_controlled_buildspec:
+    def test_project_not_buildspec(self):
+        codebuild_client = mock.MagicMock
+        codebuild_client.projects = [
+            CodebuildProject(
+                name="test", region="eu-west-1", last_invoked_time=None, buildspec=None
+            )
+        ]
+        with mock.patch(
+            "providers.aws.services.codebuild.codebuild_service.Codebuild",
+            codebuild_client,
+        ):
+            from providers.aws.services.codebuild.codebuild_project_user_controlled_buildspec.codebuild_project_user_controlled_buildspec import (
+                codebuild_project_user_controlled_buildspec,
+            )
+
+            check = codebuild_project_user_controlled_buildspec()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert search(
+                "does not use a user controlled buildspec", result[0].status_extended
+            )
+            assert result[0].resource_id == "test"
+            assert result[0].resource_arn == ""
+
+    def test_project_buildspec_not_yaml(self):
+        codebuild_client = mock.MagicMock
+        codebuild_client.projects = [
+            CodebuildProject(
+                name="test",
+                region="eu-west-1",
+                last_invoked_time=None,
+                buildspec="arn:aws:s3:::my-codebuild-sample2/buildspec.out",
+            )
+        ]
+        with mock.patch(
+            "providers.aws.services.codebuild.codebuild_service.Codebuild",
+            codebuild_client,
+        ):
+            from providers.aws.services.codebuild.codebuild_project_user_controlled_buildspec.codebuild_project_user_controlled_buildspec import (
+                codebuild_project_user_controlled_buildspec,
+            )
+
+            check = codebuild_project_user_controlled_buildspec()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert search(
+                "does not use a user controlled buildspec", result[0].status_extended
+            )
+            assert result[0].resource_id == "test"
+            assert result[0].resource_arn == ""
+
+    def test_project_valid_buildspec(self):
+        codebuild_client = mock.MagicMock
+        codebuild_client.projects = [
+            CodebuildProject(
+                name="test",
+                region="eu-west-1",
+                last_invoked_time=None,
+                buildspec="arn:aws:s3:::my-codebuild-sample2/buildspec.yaml",
+            )
+        ]
+        with mock.patch(
+            "providers.aws.services.codebuild.codebuild_service.Codebuild",
+            codebuild_client,
+        ):
+            from providers.aws.services.codebuild.codebuild_project_user_controlled_buildspec.codebuild_project_user_controlled_buildspec import (
+                codebuild_project_user_controlled_buildspec,
+            )
+
+            check = codebuild_project_user_controlled_buildspec()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert search("uses a user controlled buildspec", result[0].status_extended)
+            assert result[0].resource_id == "test"
+            assert result[0].resource_arn == ""