Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(terraform): check if SSE configuration block is nil #1457

Merged
merged 1 commit into from
Sep 19, 2023

Conversation

nikpivkin
Copy link
Collaborator

@@ -47,7 +47,7 @@ var CheckEncryptionCustomerKey = rules.Register(
if bucket.Encryption.KMSKeyId.IsEmpty() {
results.Add(
"Bucket does not encrypt data with a customer managed key.",
&bucket.Encryption,
bucket.Encryption.KMSKeyId,
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed metadata output.

before:

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:1-9
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1 ┌ resource "aws_s3_bucket" "this" {
   2 │     server_side_encryption_configuration {
   3 │       rule {
   4 │        apply_server_side_encryption_by_default {
   5 │        }
   6 │       }
   7 │     }
   8 │   
   9 └ }
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

after:

See https://avd.aquasec.com/misconfig/avd-aws-0132
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 main.tf:5
   via main.tf:4-6 (apply_server_side_encryption_by_default)
    via main.tf:3-7 (rule)
     via main.tf:2-8 (server_side_encryption_configuration)
      via main.tf:1-10 (aws_s3_bucket.this)
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   resource "aws_s3_bucket" "this" {
   2       server_side_encryption_configuration {
   3         rule {
   4          apply_server_side_encryption_by_default {
   5 [         kms_master_key_id = ""
   6          }
   7         }
   8       }
   9     
  10   }
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

@@ -299,7 +299,7 @@ func (b *Block) GetAttribute(name string) *Attribute {
return nil
}

func (b *Block) GetNestedAttribute(name string) *Attribute {
func (b *Block) GetNestedAttribute(name string) (*Attribute, *Block) {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now this function returns the parent attribute block for more accurate metadata output.

@nikpivkin nikpivkin changed the title fix: check if SSE configuration block is nil fix(terraform): check if SSE configuration block is nil Sep 19, 2023
@nikpivkin nikpivkin marked this pull request as ready for review September 19, 2023 08:45
@nikpivkin nikpivkin requested a review from simar7 as a code owner September 19, 2023 08:45
@simar7 simar7 added this pull request to the merge queue Sep 19, 2023
Merged via the queue into aquasecurity:master with commit 9e0a59f Sep 19, 2023
8 checks passed
@nikpivkin nikpivkin deleted the fix/s3-encryption branch September 20, 2023 05:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants