github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/aws/emr/enable_in_transit_encryption.go (about)

     1  package emr
     2  
     3  import (
     4  	"encoding/json"
     5  
     6  	"github.com/khulnasoft-lab/defsec/internal/rules"
     7  	"github.com/khulnasoft-lab/defsec/pkg/providers"
     8  	"github.com/khulnasoft-lab/defsec/pkg/scan"
     9  	"github.com/khulnasoft-lab/defsec/pkg/severity"
    10  	"github.com/khulnasoft-lab/defsec/pkg/state"
    11  )
    12  
    13  var CheckEnableInTransitEncryption = rules.Register(
    14  	scan.Rule{
    15  		AVDID:       "AVD-AWS-0138",
    16  		Provider:    providers.AWSProvider,
    17  		Service:     "emr",
    18  		ShortCode:   "enable-in-transit-encryption",
    19  		Summary:     "Enable in-transit encryption for EMR clusters.",
    20  		Impact:      "In-transit data in the EMR cluster could be compromised if accessed.",
    21  		Resolution:  "Enable in-transit encryption for EMR cluster",
    22  		Explanation: `Data stored within an EMR cluster should be encrypted to ensure sensitive data is kept private.`,
    23  		Links: []string{
    24  			"https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist_800-171.html",
    25  		},
    26  		Terraform: &scan.EngineMetadata{
    27  			GoodExamples:        terraformEnableInTransitEncryptionGoodExamples,
    28  			BadExamples:         terraformEnableInTransitEncryptionBadExamples,
    29  			Links:               terraformEnableInTransitEncryptionLinks,
    30  			RemediationMarkdown: terraformEnableInTransitEncryptionRemediationMarkdown,
    31  		},
    32  		Severity: severity.High,
    33  	},
    34  	func(s *state.State) (results scan.Results) {
    35  		for _, conf := range s.AWS.EMR.SecurityConfiguration {
    36  			vars, err := readVarsFromConfigurationInTransit(conf.Configuration.Value())
    37  			if err != nil {
    38  				continue
    39  			}
    40  
    41  			if !vars.EncryptionConfiguration.EnableInTransitEncryption {
    42  				results.Add(
    43  					"EMR cluster does not have in-transit encryption enabled.",
    44  					conf.Configuration,
    45  				)
    46  			} else {
    47  				results.AddPassed(&conf)
    48  			}
    49  
    50  		}
    51  		return
    52  	},
    53  )
    54  
    55  func readVarsFromConfigurationInTransit(raw string) (*conf, error) {
    56  	var testConf conf
    57  	if err := json.Unmarshal([]byte(raw), &testConf); err != nil {
    58  		return nil, err
    59  	}
    60  
    61  	return &testConf, nil
    62  }