OpenStack firewall rule does not have destination IP configured misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENSTACK_5
Category - Subcategory	Public Exposure - Ingress Controls
Provider	OTHER
Severity	LOW
Framework	Terraform

Impact

Explicitly setting a destination IP Address will make sure that the IP destination is managed in code. You also need to ensure that the destination IP is not 0.0.0.0 so that the firewall rule is exposed to the world.

How to Fix

Resource: openstack_fw_rule_v1

• Arguments: destination_ip_address

CLI

---

openstack firewall group rule create --destination-ip-address 10.0.0.1

[source,go]

resource "openstack_fw_rule_v1" "fail" { name = "my_rule_world" description = "let anyone in" action = "allow" protocol = "tcp" destination_port = "22" enabled = "true" }