[CKV2_ADO_1] False Positive

[richardsikkel]

Describe the issue [NONE][CKV2_ADO_1] Ensure at least two approving reviews for PRs

Examples

//Create baseline GIT repository for security level 1
resource "azuredevops_git_repository" "recolevelone" {
  for_each = var.projects
  project_id = data.azuredevops_project.all[each.key].id
  name       = "${each.key} Level 1 baseline"
  initialization {
    init_type = "Clean"
  }
}

resource "azuredevops_branch_policy_min_reviewers" "recolevelone" {
  for_each = var.projects
  project_id = data.azuredevops_project.all[each.key].id

  enabled  = true
  blocking = true

  settings {
    reviewer_count                         = 2
    submitter_can_vote                     = false
    last_pusher_cannot_approve             = true
    allow_completion_with_rejects_or_waits = false
    on_last_iteration_require_vote         = false

    scope {
      repository_id  = azuredevops_git_repository.recolevelone[each.key].id
      repository_ref = azuredevops_git_repository.recolevelone[each.key].default_branch
      match_type     = "Exact"
    }
  }
}

Resource: azuredevops_git_repository.recolevelone["test"]
[File: /main.tf: 371-378]
Guideline: None
371 | resource "azuredevops_git_repository" "recolevelone" {
372 |   for_each = var.projects
373 |   project_id = data.azuredevops_project.all[each.key].id
374 |   name       = "${each.key} Level 1 baseline"
375 |   initialization {
376 |     init_type = "Clean"
377 |   }
378 | }

[mannycepeda1989]

Hey @richardsikkel , I could not reproduce this issue. What version of Checkov are you using?

[richardsikkel]

Output from command line including version:

user@server:~/myagent/_work/1/s$` checkov -d ./azdevops
[ secrets framework ]: 100%|████████████████████|[4/4], Current File Scanned=./azdevops/variables.tf
[ terraform framework ]: 100%|████████████████████|[4/4], Current File Scanned=azdevops/variables.tf

       _               _              
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V / 
  \___|_| |_|\___|\___|_|\_\___/ \_/  

By Prisma Cloud | version: 3.2.141 

terraform scan results:

Passed checks: 0, Failed checks: 8, Skipped checks: 0

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelzero["demo"]
    File: /main.tf:307-314

        307 | resource "azuredevops_git_repository" "recolevelzero" {
        308 |   for_each = var.projects
        309 |   project_id = data.azuredevops_project.all[each.key].id
        310 |   name       = "${each.key} Level 0 baseline"
        311 |   initialization {
        312 |     init_type = "Clean"
        313 |   }
        314 | }

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelzerocustom["demo"]
    File: /main.tf:339-346

        339 | resource "azuredevops_git_repository" "recolevelzerocustom" {
        340 |   for_each = var.projects
        341 |   project_id = data.azuredevops_project.all[each.key].id
        342 |   name       = "${each.key} Level 0 custom"
        343 |   initialization {
        344 |     init_type = "Clean"
        345 |   }
        346 | }

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelone["demo"]
    File: /main.tf:371-378

        371 | resource "azuredevops_git_repository" "recolevelone" {
        372 |   for_each = var.projects
        373 |   project_id = data.azuredevops_project.all[each.key].id
        374 |   name       = "${each.key} Level 1 baseline"
        375 |   initialization {
        376 |     init_type = "Clean"
        377 |   }
        378 | }

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelonecustom["demo"]
    File: /main.tf:403-410

        403 | resource "azuredevops_git_repository" "recolevelonecustom" {
        404 |   for_each = var.projects
        405 |   project_id = data.azuredevops_project.all[each.key].id
        406 |   name       = "${each.key} Level 1 custom"
        407 |   initialization {
        408 |     init_type = "Clean"
        409 |   }
        410 | }

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelzero["test"]
    File: /main.tf:307-314

        307 | resource "azuredevops_git_repository" "recolevelzero" {
        308 |   for_each = var.projects
        309 |   project_id = data.azuredevops_project.all[each.key].id
        310 |   name       = "${each.key} Level 0 baseline"
        311 |   initialization {
        312 |     init_type = "Clean"
        313 |   }
        314 | }

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelzerocustom["test"]
    File: /main.tf:339-346

        339 | resource "azuredevops_git_repository" "recolevelzerocustom" {
        340 |   for_each = var.projects
        341 |   project_id = data.azuredevops_project.all[each.key].id
        342 |   name       = "${each.key} Level 0 custom"
        343 |   initialization {
        344 |     init_type = "Clean"
        345 |   }
        346 | }

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelone["test"]
    File: /main.tf:371-378

        371 | resource "azuredevops_git_repository" "recolevelone" {
        372 |   for_each = var.projects
        373 |   project_id = data.azuredevops_project.all[each.key].id
        374 |   name       = "${each.key} Level 1 baseline"
        375 |   initialization {
        376 |     init_type = "Clean"
        377 |   }
        378 | }

Check: CKV2_ADO_1: "Ensure at least two approving reviews for PRs"
    FAILED for resource: azuredevops_git_repository.recolevelonecustom["test"]
    File: /main.tf:403-410

        403 | resource "azuredevops_git_repository" "recolevelonecustom" {
        404 |   for_each = var.projects
        405 |   project_id = data.azuredevops_project.all[each.key].id
        406 |   name       = "${each.key} Level 1 custom"
        407 |   initialization {
        408 |     init_type = "Clean"
        409 |   }
        410 | }

[Saarett]

Hi @richardsikkel , thank you for reaching out. Could you please elaborate about the issue? What is the expected output and why?