fix: check all aws api pointers

internal/adapters/cloud/aws/api-gateway/apis_v1.go

@@ -72,9 +72,14 @@ func (a *adapter) adaptRestAPIV1(restAPI agTypes.RestApi) (*v1.API, error) {
 		resourcesInput.Position = resourcesOutput.Position
 	}
 
+	name := defsecTypes.StringDefault("", metadata)
+	if restAPI.Name != nil {
+		name = defsecTypes.String(*restAPI.Name, metadata)
+	}
+
 	return &v1.API{
 		Metadata:  metadata,
-		Name:      defsecTypes.String(*restAPI.Name, metadata),
+		Name:      name,
 		Stages:    stages,
 		Resources: resources,
 	}, nil
@@ -98,9 +103,14 @@ func (a *adapter) adaptStageV1(restAPI agTypes.RestApi, stage agTypes.Stage) v1.
 		})
 	}
 
+	name := defsecTypes.StringDefault("", metadata)
+	if stage.StageName != nil {
+		name = defsecTypes.String(*stage.StageName, metadata)
+	}
+
 	return v1.Stage{
 		Metadata: metadata,
-		Name:     defsecTypes.String(*stage.StageName, metadata),
+		Name:     name,
 		AccessLogging: v1.AccessLogging{
 			Metadata:              metadata,
 			CloudwatchLogGroupARN: defsecTypes.String(logARN, metadata),
@@ -121,11 +131,23 @@ func (a *adapter) adaptResourceV1(restAPI agTypes.RestApi, apiResource agTypes.R
 
 	for _, method := range apiResource.ResourceMethods {
 		metadata := a.CreateMetadata(fmt.Sprintf("/restapis/%s/resources/%s/methods/%s", *restAPI.Id, *apiResource.Id, *method.HttpMethod))
+		httpMethod := defsecTypes.StringDefault("", metadata)
+		if method.HttpMethod != nil {
+			httpMethod = defsecTypes.String(*method.HttpMethod, metadata)
+		}
+		authType := defsecTypes.StringDefault("", metadata)
+		if method.AuthorizationType != nil {
+			authType = defsecTypes.String(*method.AuthorizationType, metadata)
+		}
+		keyRequired := defsecTypes.BoolDefault(false, metadata)
+		if method.ApiKeyRequired != nil {
+			keyRequired = defsecTypes.Bool(*method.ApiKeyRequired, metadata)
+		}
 		resource.Methods = append(resource.Methods, v1.Method{
 			Metadata:          metadata,
-			HTTPMethod:        defsecTypes.String(*method.HttpMethod, metadata),
-			AuthorizationType: defsecTypes.String(*method.AuthorizationType, metadata),
-			APIKeyRequired:    defsecTypes.Bool(*method.ApiKeyRequired, metadata),
+			HTTPMethod:        httpMethod,
+			AuthorizationType: authType,
+			APIKeyRequired:    keyRequired,
 		})
 	}
 

internal/adapters/cloud/aws/athena/adapt.go

@@ -96,9 +96,14 @@ func (a *adapter) adaptWorkgroup(workgroup types.WorkGroupSummary) (*athena.Work
 
 	}
 
+	name := defsecTypes.StringDefault("", metadata)
+	if workgroup.Name != nil {
+		name = defsecTypes.String(*workgroup.Name, metadata)
+	}
+
 	return &athena.Workgroup{
 		Metadata: metadata,
-		Name:     defsecTypes.String(*workgroup.Name, metadata),
+		Name:     name,
 		Encryption: athena.EncryptionConfiguration{
 			Metadata: metadata,
 			Type:     defsecTypes.String(encType, metadata),

internal/adapters/cloud/aws/cloudtrail/adapt.go

@@ -97,14 +97,24 @@ func (a *adapter) adaptTrail(info types.TrailInfo) (*cloudtrail.Trail, error) {
 		bucketName = *response.Trail.S3BucketName
 	}
 
+	name := defsecTypes.StringDefault("", metadata)
+	if info.Name != nil {
+		name = defsecTypes.String(*info.Name, metadata)
+	}
+
+	isLogging := defsecTypes.BoolDefault(false, metadata)
+	if status.IsLogging != nil {
+		isLogging = defsecTypes.Bool(*status.IsLogging, metadata)
+	}
+
 	return &cloudtrail.Trail{
 		Metadata:                  metadata,
-		Name:                      defsecTypes.String(*info.Name, metadata),
+		Name:                      name,
 		EnableLogFileValidation:   defsecTypes.Bool(response.Trail.LogFileValidationEnabled != nil && *response.Trail.LogFileValidationEnabled, metadata),
 		IsMultiRegion:             defsecTypes.Bool(response.Trail.IsMultiRegionTrail != nil && *response.Trail.IsMultiRegionTrail, metadata),
 		CloudWatchLogsLogGroupArn: cloudWatchLogsArn,
 		KMSKeyID:                  defsecTypes.String(kmsKeyId, metadata),
-		IsLogging:                 defsecTypes.Bool(*status.IsLogging, metadata),
+		IsLogging:                 isLogging,
 		BucketName:                defsecTypes.String(bucketName, metadata),
 	}, nil
 }

internal/adapters/cloud/aws/cloudwatch/adapt.go

@@ -120,10 +120,20 @@ func (a *adapter) adaptLogGroup(group types.LogGroup) (*cloudwatch.LogGroup, err
 
 	}
 
+	arn := defsecTypes.StringDefault("", metadata)
+	if group.Arn != nil {
+		arn = defsecTypes.String(*group.Arn, metadata)
+	}
+
+	name := defsecTypes.StringDefault("", metadata)
+	if group.LogGroupName != nil {
+		name = defsecTypes.String(*group.LogGroupName, metadata)
+	}
+
 	return &cloudwatch.LogGroup{
 		Metadata:        metadata,
-		Arn:             defsecTypes.String(*group.Arn, metadata),
-		Name:            defsecTypes.String(*group.LogGroupName, metadata),
+		Arn:             arn,
+		Name:            name,
 		KMSKeyID:        defsecTypes.String(kmsKeyId, metadata),
 		RetentionInDays: defsecTypes.Int(retentionInDays, metadata),
 		MetricFilters:   metricFilters,

internal/adapters/cloud/aws/ec2/ec2.go

@@ -144,7 +144,10 @@ func (a *adapter) adaptInstance(instance ec2Types.Instance) (*ec2.Instance, erro
 	for _, v := range volumes.Volumes {
 		block := volumeBlockMap[*v.VolumeId]
 		if block != nil {
-			block.Encrypted = defsecTypes.Bool(*v.Encrypted, block.Metadata)
+			block.Encrypted = defsecTypes.BoolDefault(false, block.Metadata)
+			if v.Encrypted != nil {
+				block.Encrypted = defsecTypes.Bool(*v.Encrypted, block.Metadata)
+			}
 		}
 	}
 	return i, nil

internal/adapters/cloud/aws/ecr/adapt.go

@@ -92,9 +92,13 @@ func (a *adapter) adaptRepository(apiRepository types.Repository) (*ecr.Reposito
 		if err != nil {
 			return nil, err
 		}
+		name := defsecTypes.StringDefault("", metadata)
+		if output.RepositoryName != nil {
+			name = defsecTypes.String(*output.RepositoryName, metadata)
+		}
 		policies = append(policies, iam.Policy{
 			Metadata: metadata,
-			Name:     defsecTypes.String(*output.RepositoryName, metadata),
+			Name:     name,
 			Document: iam.Document{
 				Metadata: metadata,
 				Parsed:   *parsed,

internal/adapters/cloud/aws/efs/adapt.go

@@ -66,8 +66,12 @@ func (a *adapter) getFilesystems() ([]efs.FileSystem, error) {
 
 func (a *adapter) adaptFilesystem(apiFilesystem types.FileSystemDescription) (*efs.FileSystem, error) {
 	metadata := a.CreateMetadataFromARN(*apiFilesystem.FileSystemArn)
+	encrypted := defsecTypes.BoolDefault(false, metadata)
+	if apiFilesystem.Encrypted != nil {
+		encrypted = defsecTypes.Bool(*apiFilesystem.Encrypted, metadata)
+	}
 	return &efs.FileSystem{
 		Metadata:  metadata,
-		Encrypted: defsecTypes.Bool(*apiFilesystem.Encrypted, metadata),
+		Encrypted: encrypted,
 	}, nil
 }

internal/adapters/cloud/aws/elasticache/adapt.go

@@ -74,11 +74,27 @@ func (a *adapter) getClusters() ([]elasticache.Cluster, error) {
 
 func (a *adapter) adaptCluster(apiCluster types.CacheCluster) (*elasticache.Cluster, error) {
 	metadata := a.CreateMetadataFromARN(*apiCluster.ARN)
+
+	engine := defsecTypes.StringDefault("", metadata)
+	if apiCluster.Engine != nil {
+		engine = defsecTypes.String(*apiCluster.Engine, metadata)
+	}
+
+	nodeType := defsecTypes.StringDefault("", metadata)
+	if apiCluster.CacheNodeType != nil {
+		nodeType = defsecTypes.String(*apiCluster.CacheNodeType, metadata)
+	}
+
+	limit := defsecTypes.IntDefault(0, metadata)
+	if apiCluster.SnapshotRetentionLimit != nil {
+		limit = defsecTypes.Int(int(*apiCluster.SnapshotRetentionLimit), metadata)
+	}
+
 	return &elasticache.Cluster{
 		Metadata:               metadata,
-		Engine:                 defsecTypes.String(*apiCluster.Engine, metadata),
-		NodeType:               defsecTypes.String(*apiCluster.CacheNodeType, metadata),
-		SnapshotRetentionLimit: defsecTypes.Int(int(*apiCluster.SnapshotRetentionLimit), metadata),
+		Engine:                 engine,
+		NodeType:               nodeType,
+		SnapshotRetentionLimit: limit,
 	}, nil
 }
 
@@ -119,10 +135,20 @@ func (a *adapter) getReplicationGroups() ([]elasticache.ReplicationGroup, error)
 
 func (a *adapter) adaptReplicationGroup(apiGroup types.ReplicationGroup) (*elasticache.ReplicationGroup, error) {
 	metadata := a.CreateMetadataFromARN(*apiGroup.ARN)
+
+	transitEncrypted := defsecTypes.BoolDefault(false, metadata)
+	if apiGroup.TransitEncryptionEnabled != nil {
+		transitEncrypted = defsecTypes.Bool(*apiGroup.TransitEncryptionEnabled, metadata)
+	}
+	atRestEncrypted := defsecTypes.BoolDefault(false, metadata)
+	if apiGroup.AtRestEncryptionEnabled != nil {
+		atRestEncrypted = defsecTypes.Bool(*apiGroup.AtRestEncryptionEnabled, metadata)
+	}
+
 	return &elasticache.ReplicationGroup{
 		Metadata:                 metadata,
-		TransitEncryptionEnabled: defsecTypes.Bool(*apiGroup.TransitEncryptionEnabled, metadata),
-		AtRestEncryptionEnabled:  defsecTypes.Bool(*apiGroup.AtRestEncryptionEnabled, metadata),
+		TransitEncryptionEnabled: transitEncrypted,
+		AtRestEncryptionEnabled:  atRestEncrypted,
 	}, nil
 }
 

internal/adapters/cloud/aws/elasticsearch/adapt.go

@@ -95,9 +95,14 @@ func (a *adapter) adaptDomain(apiDomain types.DomainInfo) (*elasticsearch.Domain
 		}
 	}
 
+	name := defsecTypes.StringDefault("", metadata)
+	if apiDomain.DomainName != nil {
+		name = defsecTypes.String(*apiDomain.DomainName, metadata)
+	}
+
 	return &elasticsearch.Domain{
 		Metadata:   metadata,
-		DomainName: defsecTypes.String(*apiDomain.DomainName, metadata),
+		DomainName: name,
 		LogPublishing: elasticsearch.LogPublishing{
 			Metadata:     metadata,
 			AuditEnabled: defsecTypes.Bool(auditEnabled, metadata),

internal/adapters/cloud/aws/emr/adapt.go

@@ -80,13 +80,28 @@ func (a *adapter) adaptCluster(apiCluster types.ClusterSummary) (*emr.Cluster, e
 		return nil, err
 	}
 
+	name := defsecTypes.StringDefault("", metadata)
+	if apiCluster.Name != nil {
+		name = defsecTypes.String(*apiCluster.Name, metadata)
+	}
+
+	releaseLabel := defsecTypes.StringDefault("", metadata)
+	if output.Cluster != nil && output.Cluster.ReleaseLabel != nil {
+		releaseLabel = defsecTypes.String(*output.Cluster.ReleaseLabel, metadata)
+	}
+
+	serviceRole := defsecTypes.StringDefault("", metadata)
+	if output.Cluster != nil && output.Cluster.ServiceRole != nil {
+		serviceRole = defsecTypes.String(*output.Cluster.ServiceRole, metadata)
+	}
+
 	return &emr.Cluster{
 		Metadata: metadata,
 		Settings: emr.ClusterSettings{
 			Metadata:     metadata,
-			Name:         defsecTypes.String(*apiCluster.Name, metadata),
-			ReleaseLabel: defsecTypes.String(*output.Cluster.ReleaseLabel, metadata),
-			ServiceRole:  defsecTypes.String(*output.Cluster.ServiceRole, metadata),
+			Name:         name,
+			ReleaseLabel: releaseLabel,
+			ServiceRole:  serviceRole,
 		},
 	}, nil
 }

internal/adapters/cloud/aws/iam/policy.go

@@ -67,9 +67,14 @@ func (a *adapter) adaptPolicy(apiPolicy iamtypes.Policy) (*iam.Policy, error) {
 		return nil, err
 	}
 
+	name := defsecTypes.StringDefault("", metadata)
+	if apiPolicy.PolicyName != nil {
+		name = defsecTypes.String(*apiPolicy.PolicyName, metadata)
+	}
+
 	return &iam.Policy{
 		Metadata: metadata,
-		Name:     defsecTypes.String(*apiPolicy.PolicyName, metadata),
+		Name:     name,
 		Document: iam.Document{
 			Metadata: metadata,
 			Parsed:   *document,

internal/adapters/cloud/aws/iam/user.go

@@ -3,6 +3,7 @@ package iam
 import (
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/aquasecurity/defsec/pkg/concurrency"
 	defsecTypes "github.com/aquasecurity/defsec/pkg/types"
@@ -151,11 +152,21 @@ func (a *adapter) getUserKeys(apiUser iamtypes.User) ([]iam.AccessKey, error) {
 				}
 			}
 
+			accessKeyId := defsecTypes.StringDefault("", metadata)
+			if apiAccessKey.AccessKeyId != nil {
+				accessKeyId = defsecTypes.String(*apiAccessKey.AccessKeyId, metadata)
+			}
+
+			creationDate := defsecTypes.TimeDefault(time.Now(), metadata)
+			if apiAccessKey.CreateDate != nil {
+				creationDate = defsecTypes.Time(*apiAccessKey.CreateDate, metadata)
+			}
+
 			keys = append(keys, iam.AccessKey{
 				Metadata:     metadata,
-				AccessKeyId:  defsecTypes.String(*apiAccessKey.AccessKeyId, metadata),
+				AccessKeyId:  accessKeyId,
 				Active:       defsecTypes.Bool(apiAccessKey.Status == iamtypes.StatusTypeActive, metadata),
-				CreationDate: defsecTypes.Time(*apiAccessKey.CreateDate, metadata),
+				CreationDate: creationDate,
 				LastAccess:   lastUsed,
 			})
 		}

internal/adapters/cloud/aws/rds/rds.go

@@ -198,7 +198,6 @@ func getPerformanceInsights(enabled *bool, kmsKeyID *string, metadata defsecType
 		Enabled:  defsecTypes.BoolDefault(false, metadata),
 		KMSKeyID: defsecTypes.StringDefault("", metadata),
 	}
-
 	if enabled != nil {
 		performanceInsights.Enabled = defsecTypes.Bool(*enabled, metadata)
 	}

internal/adapters/cloud/aws/redshift/adapt.go

@@ -123,8 +123,13 @@ func (a *adapter) adaptSecurityGroup(apiSG types.ClusterSecurityGroup) (*redshif
 
 	metadata := a.CreateMetadata("securitygroup:" + *apiSG.ClusterSecurityGroupName)
 
+	description := defsecTypes.StringDefault("", metadata)
+	if apiSG.Description != nil {
+		description = defsecTypes.String(*apiSG.Description, metadata)
+	}
+
 	return &redshift.SecurityGroup{
 		Metadata:    metadata,
-		Description: defsecTypes.String(*apiSG.Description, metadata),
+		Description: description,
 	}, nil
 }

internal/adapters/cloud/aws/s3/s3.go

@@ -82,9 +82,14 @@ func (a *adapter) adaptBucket(bucket s3types.Bucket) (*s3.Bucket, error) {
 
 	bucketMetadata := a.CreateMetadata(*bucket.Name)
 
+	name := defsecTypes.StringDefault("", bucketMetadata)
+	if bucket.Name != nil {
+		name = defsecTypes.String(*bucket.Name, bucketMetadata)
+	}
+
 	b := s3.Bucket{
 		Metadata:          bucketMetadata,
-		Name:              defsecTypes.String(*bucket.Name, bucketMetadata),
+		Name:              name,
 		PublicAccessBlock: a.getPublicAccessBlock(bucket.Name, bucketMetadata),
 		BucketPolicies:    a.getBucketPolicies(bucket.Name, bucketMetadata),
 		Encryption:        a.getBucketEncryption(bucket.Name, bucketMetadata),