github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/aws/rds/encrypt_cluster_storage_data_test.go (about) 1 package rds 2 3 import ( 4 "testing" 5 6 defsecTypes "github.com/khulnasoft-lab/defsec/pkg/types" 7 8 "github.com/khulnasoft-lab/defsec/pkg/state" 9 10 "github.com/khulnasoft-lab/defsec/pkg/providers/aws/rds" 11 "github.com/khulnasoft-lab/defsec/pkg/scan" 12 13 "github.com/stretchr/testify/assert" 14 ) 15 16 func TestCheckEncryptClusterStorageData(t *testing.T) { 17 tests := []struct { 18 name string 19 input rds.RDS 20 expected bool 21 }{ 22 { 23 name: "RDS Cluster with storage encryption disabled", 24 input: rds.RDS{ 25 Clusters: []rds.Cluster{ 26 { 27 Metadata: defsecTypes.NewTestMetadata(), 28 Encryption: rds.Encryption{ 29 Metadata: defsecTypes.NewTestMetadata(), 30 EncryptStorage: defsecTypes.Bool(false, defsecTypes.NewTestMetadata()), 31 KMSKeyID: defsecTypes.String("kms-key", defsecTypes.NewTestMetadata()), 32 }, 33 }, 34 }, 35 }, 36 expected: true, 37 }, 38 { 39 name: "RDS Cluster with storage encryption enabled but missing KMS key", 40 input: rds.RDS{ 41 Clusters: []rds.Cluster{ 42 { 43 Metadata: defsecTypes.NewTestMetadata(), 44 Encryption: rds.Encryption{ 45 Metadata: defsecTypes.NewTestMetadata(), 46 EncryptStorage: defsecTypes.Bool(true, defsecTypes.NewTestMetadata()), 47 KMSKeyID: defsecTypes.String("", defsecTypes.NewTestMetadata()), 48 }, 49 }, 50 }, 51 }, 52 expected: true, 53 }, 54 { 55 name: "RDS Cluster with storage encryption enabled and KMS key provided", 56 input: rds.RDS{ 57 Clusters: []rds.Cluster{ 58 { 59 Metadata: defsecTypes.NewTestMetadata(), 60 Encryption: rds.Encryption{ 61 Metadata: defsecTypes.NewTestMetadata(), 62 EncryptStorage: defsecTypes.Bool(true, defsecTypes.NewTestMetadata()), 63 KMSKeyID: defsecTypes.String("kms-key", defsecTypes.NewTestMetadata()), 64 }, 65 }, 66 }, 67 }, 68 expected: false, 69 }, 70 } 71 for _, test := range tests { 72 t.Run(test.name, func(t *testing.T) { 73 var testState state.State 74 testState.AWS.RDS = test.input 75 results := CheckEncryptClusterStorageData.Evaluate(&testState) 76 var found bool 77 for _, result := range results { 78 if result.Status() == scan.StatusFailed && result.Rule().LongID() == CheckEncryptClusterStorageData.Rule().LongID() { 79 found = true 80 } 81 } 82 if test.expected { 83 assert.True(t, found, "Rule should have been found") 84 } else { 85 assert.False(t, found, "Rule should not have been found") 86 } 87 }) 88 } 89 }