restrict-source-address-rules.sentinel

# Import common-functions/tfplan-functions/tfplan-functions.sentinel
# with alias "plan"
import "tfplan-functions" as plan

# Get all Security Groups
allSRGs = plan.find_resources("panos_security_rule_group")

# Validate Security Rule Groups
violatingSRGsCount = 0
for allSRGs as address, srg {

  # Find the rules of the current SRG
  rules = plan.find_blocks(srg, "rule")

  # Filter to violating rules that contain "any" or "0.0.0.0/0" in source_addresses
  # Warnings will not be printed for violations since the last parameter is false
  violatingRules = plan.filter_attribute_contains_items_from_list(rules,
                 "source_addresses", ["any","0.0.0.0/0"], false)

  # Print violation messages
  if length(violatingRules["messages"]) > 0 {
    violatingSRGsCount += 1
    print("SRG Rule Violation:", address, "has at least one rule",
          "with source_addresses containing \"any or 0.0.0.0/0\".")
    plan.print_violations(violatingRules["messages"], "Rule")
  }  // end if

} // end for SRGs

# Main rule
main = rule {
  violatingSRGsCount is 0
}