feat(query): implements "Beta - Backup Vault Without Soft Delete"

assets/queries/terraform/azure/backup_vault_without_soft_delete/metadata.json

@@ -0,0 +1,14 @@
+{
+  "id": "8d407b28-c746-4650-8bbd-d27df54a795f",
+  "queryName": "Beta - Backup Vault Without Soft Delete",
+  "severity": "HIGH",
+  "category": "Backup",
+  "descriptionText": "No 'azurerm_data_protection_backup_vault' resource should set 'soft_delete' to off, this makes it impossible to recover backup data",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/data_protection_backup_vault#soft_delete-1",
+  "platform": "Terraform",
+  "descriptionID": "8d407b28",
+  "cloudProvider": "azure",
+  "cwe": "754",
+  "riskScore": "6.0",
+  "experimental": "true"
+}

assets/queries/terraform/azure/backup_vault_without_soft_delete/query.rego

@@ -0,0 +1,21 @@
+package Cx
+
+import data.generic.common as common_lib
+import data.generic.terraform as tf_lib
+
+CxPolicy[result] {
+	resource := input.document[i].resource.azurerm_data_protection_backup_vault[name]
+
+	resource.soft_delete == "off"
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": "azurerm_data_protection_backup_vault",
+		"resourceName": tf_lib.get_resource_name(resource, name),
+		"searchKey": sprintf("azurerm_data_protection_backup_vault[%s].soft_delete", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'azurerm_data_protection_backup_vault[%s].soft_delete' should not be set to 'off'", [name]),
+		"keyActualValue": sprintf("'azurerm_data_protection_backup_vault[%s].soft_delete' is set to 'off'", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "azurerm_data_protection_backup_vault", name, "soft_delete"], [])
+	}
+}

assets/queries/terraform/azure/backup_vault_without_soft_delete/test/negative.tf

@@ -0,0 +1,29 @@
+resource "azurerm_data_protection_backup_vault" "negative1" {
+  name                = "negative1-backup-vault"
+  resource_group_name = azurerm_resource_group.negative1.name
+  location            = azurerm_resource_group.negative1.location
+  datastore_type      = "VaultStore"
+  redundancy          = "LocallyRedundant"
+
+  # missing soft_delete - defaults to on
+}
+
+resource "azurerm_data_protection_backup_vault" "negative2" {
+  name                = "negative2-backup-vault"
+  resource_group_name = azurerm_resource_group.negative2.name
+  location            = azurerm_resource_group.negative2.location
+  datastore_type      = "VaultStore"
+  redundancy          = "LocallyRedundant"
+
+  soft_delete = "on"
+}
+
+resource "azurerm_data_protection_backup_vault" "negative3" {
+  name                = "negative3-backup-vault"
+  resource_group_name = azurerm_resource_group.negative3.name
+  location            = azurerm_resource_group.negative3.location
+  datastore_type      = "VaultStore"
+  redundancy          = "LocallyRedundant"
+
+  soft_delete = "AlwaysOn"
+}

assets/queries/terraform/azure/backup_vault_without_soft_delete/test/positive.tf

@@ -0,0 +1,9 @@
+resource "azurerm_data_protection_backup_vault" "positive" {
+  name                = "positive-backup-vault"
+  resource_group_name = azurerm_resource_group.positive.name
+  location            = azurerm_resource_group.positive.location
+  datastore_type      = "VaultStore"
+  redundancy          = "LocallyRedundant"
+
+  soft_delete = "off"
+}

assets/queries/terraform/azure/backup_vault_without_soft_delete/test/positive_expected_result.json

@@ -0,0 +1,7 @@
+[
+  {
+    "queryName": "Beta - Backup Vault Without Soft Delete",
+    "severity": "HIGH",
+    "line": 8
+  }
+]

assets/similarityID_transition/terraform_azure.yaml

@@ -3,3 +3,7 @@ similarityIDChangeList:
       queryName: Sensitive Port Is Exposed To Wide Private Network
       observations: ""
       change: 5
+    - queryId: 8d407b28-c746-4650-8bbd-d27df54a795f
+      queryName: Beta - Backup Vault Without Soft Delete
+      observations: ""
+      change: 2