github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/aws/elasticache/enable_at_rest_encryption.go (about) 1 package elasticache 2 3 import ( 4 "github.com/khulnasoft-lab/defsec/internal/rules" 5 "github.com/khulnasoft-lab/defsec/pkg/providers" 6 "github.com/khulnasoft-lab/defsec/pkg/scan" 7 "github.com/khulnasoft-lab/defsec/pkg/severity" 8 "github.com/khulnasoft-lab/defsec/pkg/state" 9 ) 10 11 var CheckEnableAtRestEncryption = rules.Register( 12 scan.Rule{ 13 AVDID: "AVD-AWS-0045", 14 Provider: providers.AWSProvider, 15 Service: "elasticache", 16 ShortCode: "enable-at-rest-encryption", 17 Summary: "Elasticache Replication Group stores unencrypted data at-rest.", 18 Impact: "At-rest data in the Replication Group could be compromised if accessed.", 19 Resolution: "Enable at-rest encryption for replication group", 20 Explanation: `Data stored within an Elasticache replication node should be encrypted to ensure sensitive data is kept private.`, 21 Links: []string{ 22 "https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/at-rest-encryption.html", 23 }, 24 Terraform: &scan.EngineMetadata{ 25 GoodExamples: terraformEnableAtRestEncryptionGoodExamples, 26 BadExamples: terraformEnableAtRestEncryptionBadExamples, 27 Links: terraformEnableAtRestEncryptionLinks, 28 RemediationMarkdown: terraformEnableAtRestEncryptionRemediationMarkdown, 29 }, 30 Severity: severity.High, 31 }, 32 func(s *state.State) (results scan.Results) { 33 for _, group := range s.AWS.ElastiCache.ReplicationGroups { 34 if group.AtRestEncryptionEnabled.IsFalse() { 35 results.Add( 36 "Replication group does not have at-rest encryption enabled.", 37 group.AtRestEncryptionEnabled, 38 ) 39 } else { 40 results.AddPassed(&group) 41 } 42 } 43 return 44 }, 45 )