Add rule to check for protocol -1

cli/assets/terraform.yml

@@ -123,6 +123,30 @@ rules:
       - sg
       - ec2
 
+  - id: SG_INGRESS_ALL_PROTOCOLS
+    resource: aws_security_group
+    message: Best practices recommend not opening all protocols and ports to ingress traffic
+    assertions:
+      - not:
+        - key: "ingress[].protocol"
+          op: contains
+          value: "-1"
+    severity: WARNING
+    tags:
+      - sg
+
+  - id: SG_EGRESS_ALL_PROTOCOLS
+    resource: aws_security_group
+    message: Best practices recommend not opening all protocols and ports to egress traffic
+    assertions:
+      - not:
+        - key: "egress[].protocol"
+          op: contains
+          value: "-1"
+    severity: WARNING
+    tags:
+      - sg
+
   - id: CLOUDFRONT_DISTRIBUTION_LOGGING
     message: CloudFront Distribution must configure logging
     resource: aws_cloudfront_distribution

cli/builtin_terraform_test.go

@@ -52,6 +52,8 @@ func TestTerraformBuiltInRules(t *testing.T) {
 		{"security-groups.tf", "SG_INGRESS_PORT_RANGE", 0, 0},
 		{"security-groups.tf", "SG_EGRESS_PORT_RANGE", 0, 0},
 		{"security-groups.tf", "SG_MISSING_EGRESS", 0, 0},
+		{"security-groups.tf", "SG_INGRESS_ALL_PROTOCOLS", 1, 0},
+		{"security-groups.tf", "SG_EGRESS_ALL_PROTOCOLS", 3, 0},
 		{"cloudfront.tf", "CLOUDFRONT_DISTRIBUTION_LOGGING", 0, 1},
 		{"cloudfront.tf", "CLOUDFRONT_DISTRIBUTION_ORIGIN_POLICY", 0, 0},
 		{"cloudfront.tf", "CLOUDFRONT_DISTRIBUTION_DISTRIBUTION_PROTOCOl", 0, 0},

cli/testdata/builtin/terraform/security-groups.tf

@@ -31,3 +31,17 @@ resource "aws_security_group" "sg_ssh" {
     cidr_blocks     = ["0.0.0.0/0"]
   }
 }
+
+resource "aws_security_group" "sg_all_protocols" {
+  name = "all_all_protocols"
+  description = "Allow all protocols and ports"
+
+  ingress {
+    protocol    = "-1"
+    cidr_blocks = "1.2.3.4/32"
+  }
+  egress {
+    protocol    = "-1"
+    cidr_blocks = "1.2.3.4/32"
+  }
+}