Terrascan wrongly reports a accurics.gcp.NS.130 (checkIpForward) violation about terrascan

[williepaul]

Hi @ferrarimarco, appreciate the bug report. I verified the issue on my dev box, and it's definitely a policy bug.

Basically, it looks like the intention for the checkIpForward rule was to check if !(.can_ip_forward == true), but due to syntax, "not api.config.can_ip_forward" actually checks if a key does not exist, which in this case is true (it's not in the test file).
Since the can_ip_forward rule defaults to false, removing the "not" and just checking for can_ip_forward == true should suffice.

pkg/policies/opa/rego/gcp/google_compute_instance/checkIpForward.rego:

checkIpForward[api.id]
{
api := input.google_compute_instance[_]
not api.config.can_ip_forward == true
}

Fixed:
checkIpForward[api.id]
{
api := input.google_compute_instance[_]
api.config.can_ip_forward == true
}

I'll check in the fix shortly.