github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/compute/disk_encryption_customer_key.go (about) 1 package compute 2 3 import ( 4 "github.com/khulnasoft-lab/defsec/internal/rules" 5 "github.com/khulnasoft-lab/defsec/pkg/providers" 6 "github.com/khulnasoft-lab/defsec/pkg/scan" 7 "github.com/khulnasoft-lab/defsec/pkg/severity" 8 "github.com/khulnasoft-lab/defsec/pkg/state" 9 ) 10 11 var CheckDiskEncryptionCustomerKey = rules.Register( 12 scan.Rule{ 13 AVDID: "AVD-GCP-0034", 14 Provider: providers.GoogleProvider, 15 Service: "compute", 16 ShortCode: "disk-encryption-customer-key", 17 Summary: "Disks should be encrypted with customer managed encryption keys", 18 Impact: "Using unmanaged keys does not allow for proper key management.", 19 Resolution: "Use managed keys to encrypt disks.", 20 Explanation: `Using unmanaged keys makes rotation and general management difficult.`, 21 Links: []string{}, 22 Terraform: &scan.EngineMetadata{ 23 GoodExamples: terraformDiskEncryptionCustomerKeyGoodExamples, 24 BadExamples: terraformDiskEncryptionCustomerKeyBadExamples, 25 Links: terraformDiskEncryptionCustomerKeyLinks, 26 RemediationMarkdown: terraformDiskEncryptionCustomerKeyRemediationMarkdown, 27 }, 28 Severity: severity.Low, 29 }, 30 func(s *state.State) (results scan.Results) { 31 for _, disk := range s.Google.Compute.Disks { 32 if disk.Metadata.IsUnmanaged() { 33 continue 34 } 35 if disk.Encryption.KMSKeyLink.IsEmpty() { 36 results.Add( 37 "Disk is not encrypted with a customer managed key.", 38 disk.Encryption.KMSKeyLink, 39 ) 40 } else { 41 results.AddPassed(&disk) 42 } 43 } 44 return 45 }, 46 )