github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/aws/documentdb/encryption_customer_key_test.go (about) 1 package documentdb 2 3 import ( 4 "testing" 5 6 defsecTypes "github.com/khulnasoft-lab/defsec/pkg/types" 7 8 "github.com/khulnasoft-lab/defsec/pkg/state" 9 10 "github.com/khulnasoft-lab/defsec/pkg/providers/aws/documentdb" 11 "github.com/khulnasoft-lab/defsec/pkg/scan" 12 13 "github.com/stretchr/testify/assert" 14 ) 15 16 func TestCheckEncryptionCustomerKey(t *testing.T) { 17 tests := []struct { 18 name string 19 input documentdb.DocumentDB 20 expected bool 21 }{ 22 { 23 name: "DocDB Cluster encryption missing KMS key", 24 input: documentdb.DocumentDB{ 25 Clusters: []documentdb.Cluster{ 26 { 27 Metadata: defsecTypes.NewTestMetadata(), 28 KMSKeyID: defsecTypes.String("", defsecTypes.NewTestMetadata()), 29 }, 30 }, 31 }, 32 expected: true, 33 }, 34 { 35 name: "DocDB Instance encryption missing KMS key", 36 input: documentdb.DocumentDB{ 37 Clusters: []documentdb.Cluster{ 38 { 39 Metadata: defsecTypes.NewTestMetadata(), 40 KMSKeyID: defsecTypes.String("kms-key", defsecTypes.NewTestMetadata()), 41 Instances: []documentdb.Instance{ 42 { 43 Metadata: defsecTypes.NewTestMetadata(), 44 KMSKeyID: defsecTypes.String("", defsecTypes.NewTestMetadata()), 45 }, 46 }, 47 }, 48 }, 49 }, 50 expected: true, 51 }, 52 { 53 name: "DocDB Cluster and Instance encrypted with proper KMS keys", 54 input: documentdb.DocumentDB{ 55 Clusters: []documentdb.Cluster{ 56 { 57 Metadata: defsecTypes.NewTestMetadata(), 58 KMSKeyID: defsecTypes.String("kms-key", defsecTypes.NewTestMetadata()), 59 Instances: []documentdb.Instance{ 60 { 61 Metadata: defsecTypes.NewTestMetadata(), 62 KMSKeyID: defsecTypes.String("kms-key", defsecTypes.NewTestMetadata()), 63 }, 64 }, 65 }, 66 }, 67 }, 68 expected: false, 69 }, 70 } 71 for _, test := range tests { 72 t.Run(test.name, func(t *testing.T) { 73 var testState state.State 74 testState.AWS.DocumentDB = test.input 75 results := CheckEncryptionCustomerKey.Evaluate(&testState) 76 var found bool 77 for _, result := range results { 78 if result.Status() == scan.StatusFailed && result.Rule().LongID() == CheckEncryptionCustomerKey.Rule().LongID() { 79 found = true 80 } 81 } 82 if test.expected { 83 assert.True(t, found, "Rule should have been found") 84 } else { 85 assert.False(t, found, "Rule should not have been found") 86 } 87 }) 88 } 89 }