Back to Checks
iac

Missing security group for vpnGateway.

NIF-0018
Service: networkSeverity: critical
OfficialBuilt-inVerified

Need to add a security group to your vpnGateway.

Prowler logoProwlerprowler-provider-iac

Run this check with Prowler

Run in Prowler Cloud
Run
prowler iac --checks NIF-0018

Recommendation

Add security group for all vpnGateways

Check Code

# METADATA
# title: Missing security group for vpnGateway.
# description: |
#   Need to add a security group to your vpnGateway.
# scope: package
# schemas:
#   - input: schema["cloud"]
# related_resources:
#   - https://pfs.nifcloud.com/help/vpngw/change.htm
# custom:
#   id: NIF-0018
#   long_id: nifcloud-network-add-security-group-to-vpn-gateway
#   aliases:
#     - AVD-NIF-0018
#     - add-security-group-to-vpn-gateway
#     - nifcloud-network-add-security-group-to-vpn-gateway
#     - nifcloud-computing-add-security-group-to-vpn-gateway
#   provider: nifcloud
#   service: network
#   severity: CRITICAL
#   recommended_action: Add security group for all vpnGateways
#   input:
#     selector:
#       - type: cloud
#         subtypes:
#           - service: network
#             provider: nifcloud
#   examples: checks/cloud/nifcloud/network/add_security_group_to_vpn_gateway.yaml
package builtin.nifcloud.network.nifcloud0018

import rego.v1

import data.lib.cloud.value

deny contains res if {
	some gateway in input.nifcloud.network.vpngateways
	without_sg(gateway)
	res := result.new("VpnGateway does not have a security group.", gateway.securitygroup)
}

without_sg(gateway) if value.is_empty(gateway.securitygroup)

without_sg(gateway) if not gateway.securitygroup

References