fix(cloud): Fix KMSKeyID check

Fixes: aquasecurity/trivy#4628 Signed-off-by: Simar <[email protected]>
aquasecurity · Jun 30, 2023 · 11d9cfa · 11d9cfa
1 parent 46eeeb0
commit 11d9cfa
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/internal/adapters/cloud/aws/rds/rds.go b/internal/adapters/cloud/aws/rds/rds.go
@@ -336,10 +336,15 @@ func (a *adapter) adaptDBSnapshots(dbSnapshots types.DBSnapshot) (*rds.Snapshots
 		DBSnapshotIdentifier: defsecTypes.String(*dbSnapshots.DBSnapshotIdentifier, metadata),
 		DBSnapshotArn:        defsecTypes.String(*dbSnapshots.DBSnapshotArn, metadata),
 		Encrypted:            defsecTypes.Bool(dbSnapshots.Encrypted, metadata),
-		KmsKeyId:             defsecTypes.String(*dbSnapshots.KmsKeyId, metadata),
+		KmsKeyId:             defsecTypes.String("", metadata),
 		SnapshotAttributes:   SnapshotAttributes,
 	}
 
+	// KMSKeyID is only set if Encryption is enabled
+	if snapshots.Encrypted.IsTrue() {
+		snapshots.KmsKeyId = defsecTypes.StringDefault(*dbSnapshots.KmsKeyId, metadata)
+	}
+
 	return snapshots, nil
 }