Best way to control whether a query is "skipped" or produces a "pass / fail"

[scottford-io]

Hello 👋 ,

I am trying to create a cnspec query (assertion) for GCP Terraform that checks whether a google_compute_instance that checks whether the instance is being assigned a public IP.

If the instance block does not have an access_config block, then the check should pass. If it does have an access_config block and the config is empty then it should fail.

This should pass...

        resource "google_compute_instance" "pass" {
          name         = "test"
          machine_type = "e2-medium"
          zone         = "us-central1-a"

          tags = ["foo", "bar"]

          boot_disk {
            initialize_params {
              image = "debian-cloud/debian-9"
            }
          }

          network_interface {
            network = "default"
          }
        }

This should fail ...

        resource "google_compute_instance" "fail" {
          name         = "test"
          machine_type = "e2-medium"
          zone         = "us-central1-a"

          tags = ["foo", "bar"]

          boot_disk {
            initialize_params {
              image = "debian-cloud/debian-9"
            }
          }

          network_interface {
            network = "default"
            access_config {
              // Ephemeral IP
            }
          }
        }

right now, the mql I have catches the second scenario, but not the first.

      terraform.resources.where( nameLabel  == "google_compute_instance") { 
        blocks.where( type == "network_interface") { 
          blocks.where( type == "access_config") {
            arguments.values.length != 0 
          } 
        } 
      }

Should I use an if statement here? If the access_config block does not exist, I do not think the scan should show skipped, it should so passed because it is a secure configuration. What is the best option to ensure the check is not skipped? 🤔

[arlimus]

Hiya! We can avoid that if-condition if we use a slightly different check: all can for example check if all entries in a block satisfy a condition. If the block is empty, all entries will automatically satisfy the condition.

Looking at your current code:

terraform.resources
  .where( nameLabel  == "google_compute_instance") {
    blocks.where( type == "network_interface") { 
      blocks
        .where( type == "access_config")
        .all( arguments.values.length != 0 ) 
    }
  }

Now it says: (1) blocks (2) where the type is access_config should (3) all have non-empty arguments.

[scottford-io]

@arlimus I just tried the updated query on a google_compute_instance resource with no access_config block, and the control still skipped:

[scottford-io]

@arlimus turns out my version of cnquery needed to be updated. The query you shared worked!