[Terraform] Add for_each support to prevent false positives

[leandroyou]

Expected Behavior

Not throwing a Redis Publicly Accessible Vulnerability error when using a for_each on azurerm_redis_firewall_rule resource

Actual Behavior

Vulnerability Redis Publicly Accessible found on resource azurerm_redis_firewall_rule when using a for_each. If I remove the for_each from the azurerm_redis_firewall_rule resource and instantiate with the same IP defined on the redis variable the error will not show up.

Steps to Reproduce the Problem

1. Instantiate azurerm_redis_firewall_rule resource
2. Use a for_each to dynamically create resources
3. Set start_ip and end_ip to the for_each value using each.value

locals {
  redis_allowed_ips = ["10.0.0.1"]
}

resource "azurerm_redis_cache" "redis" {
  name                = "redis"
  location            = "location"
  resource_group_name = "resource_group_name"
  capacity            = 1
  family              = "P"
  sku_name            = "Premium"

  redis_configuration {
  }
}

resource "azurerm_redis_firewall_rule" "firewall_rule" {
  for_each = local.redis_allowed_ips

  name                = "redis_firewall_rule_${replace(each.value, ".", "_")}"
  redis_cache_name    = azurerm_redis_cache.redis.name
  resource_group_name = "resource_group_name"
  start_ip            = each.value
  end_ip              = each.value
}

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.86.0"
    }
  }
}

Specifications

(N/A if not applicable)

• Version: v1.5.5
• Platform: Terraform
• Subsystem: N/A

[leandroyou]

I just noticed that in my example above I used locals but in my project I used variables. So this issue is not related with the problem.

A new example without locals:

variable redis_allowed_ips{
  type = set(string)
  default = ["10.0.0.1"]
}

resource "azurerm_redis_cache" "redis" {
  name                = "redis"
  location            = "location"
  resource_group_name = "resource_group_name"
  capacity            = 1
  family              = "P"
  sku_name            = "Premium"

  redis_configuration {
  }
}

resource "azurerm_redis_firewall_rule" "firewall_rule" {
  for_each = var.redis_allowed_ips

  name                = "redis_firewall_rule_${replace(each.value, ".", "_")}"
  redis_cache_name    = azurerm_redis_cache.redis.name
  resource_group_name = "resource_group_name"
  start_ip            = each.value
  end_ip              = each.value
}

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.86.0"
    }
  }
}

[cxAndreFelicidade]

Hello @leandroyou, thank you for noticing that! You are correct, the problem here is that currently we do not support the for_each syntax, which gives you that false positive. We are currently researching to see if we can incorporate the for_each syntax in KICS.

[leandroyou]

Hello @cxAndreFelicidade, thank you for the information, I will be waiting for an update.

[leandroyou]

@cxAndreFelicidade I changed the issue title to prevent further duplicates such as #5312

[cxAndreFelicidade]

@leandroyou thank you for being so attentive!

[anterosilva1985]

Currently we don't have any plans to support this.