Repository: aquasecurity/tfsec (go)

Issue:
AWS SSM - convert tfsec checks to use defsec logic
Adapt AWS SSM Secrets to Go structs based on #1194 instructions:

Remove tfsec logic from `internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule.go`

Create adapt functions to populate the Go structs in `internal/app/tfsec/adapter/aws/ssm/adapt.go`

Pull request:
AWS SSM adapt to use defsec
Closes #1289 

Patch:
diff --git a/internal/app/tfsec/adapter/aws/ssm/adapt.go b/internal/app/tfsec/adapter/aws/ssm/adapt.go
index 200976252..3c2af86e5 100644
--- a/internal/app/tfsec/adapter/aws/ssm/adapt.go
+++ b/internal/app/tfsec/adapter/aws/ssm/adapt.go
@@ -2,9 +2,42 @@ package ssm
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/ssm"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) ssm.SSM {
-	return ssm.SSM{}
+	return ssm.SSM{
+		Secrets: adaptSecrets(modules),
+	}
+}
+
+func adaptSecrets(modules []block.Module) []ssm.Secret {
+	var secrets []ssm.Secret
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_secretsmanager_secret") {
+			secrets = append(secrets, adaptSecret(resource, module))
+		}
+	}
+	return secrets
+}
+
+func adaptSecret(resource block.Block, module block.Module) ssm.Secret {
+	KMSKeyIDAttr := resource.GetAttribute("kms_key_id")
+	KMSKeyIDVal := KMSKeyIDAttr.AsStringValueOrDefault("alias/aws/secretsmanager", resource)
+
+	if KMSKeyIDAttr.IsDataBlockReference() {
+		kmsData, err := module.GetReferencedBlock(KMSKeyIDAttr, resource)
+		if err != nil {
+			KMSKeyIDVal = types.StringDefault("alias/aws/secretsmanager", KMSKeyIDAttr.Metadata())
+		} else {
+			keyIDAttr := kmsData.GetAttribute("key_id")
+			KMSKeyIDVal = keyIDAttr.AsStringValueOrDefault("alias/aws/secretsmanager", kmsData)
+		}
+	}
+
+	return ssm.Secret{
+		Metadata: *resource.GetMetadata(),
+		KMSKeyID: KMSKeyIDVal,
+	}
 }
diff --git a/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule.go b/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule.go
index 79cfde944..5129d8bdb 100644
--- a/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule.go
+++ b/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule.go
@@ -1,9 +1,7 @@
 package ssm
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/ssm"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -32,26 +30,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_secretsmanager_secret"},
 		Base:           ssm.CheckSecretUseCustomerKey,
-		CheckTerraform: func(resourceBlock block.Block, module block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("kms_key_id") {
-				results.Add("Resource does not use CMK", resourceBlock)
-				return
-			}
-
-			kmsKeyAttr := resourceBlock.GetAttribute("kms_key_id")
-			if kmsKeyAttr.IsDataBlockReference() {
-				kmsData, err := module.GetReferencedBlock(kmsKeyAttr, resourceBlock)
-				if err != nil {
-					return
-				}
-				keyIdAttr := kmsData.GetAttribute("key_id")
-				if keyIdAttr.IsNotNil() && keyIdAttr.Equals("alias/aws/secretsmanager") {
-					results.Add("Resource explicitly uses the default CMK", keyIdAttr)
-				}
-			}
-
-			return results
-		},
 	})
 }


Test patch:
diff --git a/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule_test.go b/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule_test.go
index dc8d8ad41..9e899dc28 100644
--- a/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule_test.go
+++ b/internal/app/tfsec/rules/aws/ssm/secret_use_customer_key_rule_test.go
@@ -39,18 +39,17 @@ func Test_AWSSecretsManagerSecretEncryption(t *testing.T) {
 			mustIncludeResultCode: expectedCode,
 		},
 		{
-			name: "Secret with customer control CMK passes check",
+			name: "Secret without specified CMK fails check",
 			source: `
  					data "aws_kms_key" "by_alias" {
- 						key_id = "alias/aws/secretsmanager"
  					  }
  
- 		resource "aws_secretsmanager_secret" "good_example" {
+ 		resource "aws_secretsmanager_secret" "bad_example" {
  		  name       = "lambda_password"
- 		  kms_key_id = aws_kms_key.secrets.arn
+ 		  kms_key_id = data.aws_kms_key.by_alias.arn
  		}
  		`,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Secret with customer control CMK passes check",