fix(selectors): Evaluate policy when no selectors are present (#1213)

Signed-off-by: Simar <simar@linux.com>
aquasecurity · Feb 28, 2023 · d994770 · d994770
1 parent 2d6fe11
commit d994770
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/pkg/rego/scanner.go b/pkg/rego/scanner.go
@@ -285,7 +285,7 @@ func isPolicyWithSubtype(sourceType types.Source) bool {
 }
 
 func checkSubtype(ii map[string]interface{}, provider string, subTypes []SubType) bool {
-	if len(subTypes) == 0 { // policy always applies if no subtypes
+	if len(subTypes) == 0 {
 		return true
 	}
 
@@ -318,6 +318,10 @@ func isPolicyApplicable(staticMetadata *StaticMetadata, inputs ...Input) bool {
 					continue
 				}
 
+				if len(staticMetadata.InputOptions.Selectors) == 0 { // policy always applies if no selectors
+					return true
+				}
+
 				// check metadata for subtype
 				for _, s := range staticMetadata.InputOptions.Selectors {
 					if checkSubtype(ii, provider, s.Subtypes) {

diff --git a/pkg/scanners/cloud/aws/scanner_test.go b/pkg/scanners/cloud/aws/scanner_test.go
@@ -105,7 +105,7 @@ deny[res] {
 			expectedResults: struct {
 				totalResults int
 				summaries    []string
-			}{totalResults: 0},
+			}{totalResults: 2, summaries: []string{"RDS Publicly Accessible", "CloudTrail Bucket Delete Policy"}},
 		},
 		{
 			name: "selector is empty",
@@ -146,7 +146,7 @@ deny[res] {
 			expectedResults: struct {
 				totalResults int
 				summaries    []string
-			}{totalResults: 0},
+			}{totalResults: 2, summaries: []string{"RDS Publicly Accessible", "CloudTrail Bucket Delete Policy"}},
 		},
 		{
 			name: "selector without subtype",