Repository: Checkmarx/kics (language: python)

Issue:
False positive for serverless functions without environment variables using query `serverless_function_environment_variables_not_encrypted`
Serverless functions without environment variables should as far as I understand the issue not pose any risks.

Example file:
```
frameworkVersion: '2'
service:
  name: service-name
 
provider:
  name: aws
 
functions:
  hello:
    handler: handler.hello
```
### Expected Behavior

I would expect kics to not report this issue for serverless functions without environment variables.

### Actual Behavior

Kics reports false positive findings for functions like the one provided in the example.




### Steps to Reproduce the Problem

(Command line arguments and flags used)

1.  step 1
2.  step 2
3.  step 3

### Specifications
(N/A if not applicable)

-   Version:
-   Platform:
-   Subsystem: 



Discussion / hints:

Fix patch:
diff --git a/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/query.rego b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/query.rego
index fc99078cbf3..9b9f879ab33 100644
--- a/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/query.rego
+++ b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/query.rego
@@ -8,8 +8,9 @@ CxPolicy[result] {
 	functions := document.functions
 	function := functions[fname]
 
+	common_lib.valid_key(function, "environment")
 	not common_lib.valid_key(function, "kmsKeyArn")
-	not hasKMSarnAtProvider(document)
+
 
 	result := {
 		"documentId": input.document[i].id,
@@ -23,6 +24,23 @@ CxPolicy[result] {
 	}
 }
 
+CxPolicy[result] {
+	document := input.document[i]
+
+	common_lib.valid_key(document.provider, "environment")
+	not hasKMSarnAtProvider(document)
+	
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": "provider",
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "'kmsKeyArn' should be defined inside the provider",
+		"keyActualValue": "'kmsKeyArn' is not defined",
+		"searchLine": common_lib.build_search_line(["provider"], []),
+	}
+}
+
 hasKMSarnAtProvider(doc){
 	common_lib.valid_key(doc.provider, "kmsKeyArn")
 }


Test patch:
diff --git a/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/negative1.yml b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/negative1.yml
index 16786a6afad..e3830631469 100644
--- a/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/negative1.yml
+++ b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/negative1.yml
@@ -5,6 +5,7 @@ service:
  
 provider:
   name: aws
+  kmsKeyArn: arn:aws:kms:us-east-1:XXXXXX:key/some-hash
   environment:
     TABLE_NAME: tableName1
  
diff --git a/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/positive2.yml b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/positive2.yml
new file mode 100644
index 00000000000..16786a6afad
--- /dev/null
+++ b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/positive2.yml
@@ -0,0 +1,19 @@
+frameworkVersion: '2'
+service:
+  name: service-name
+  awsKmsKeyArn: arn:aws:kms:us-east-1:XXXXXX:key/some-hash
+ 
+provider:
+  name: aws
+  environment:
+    TABLE_NAME: tableName1
+ 
+functions:
+  hello: # this function will OVERWRITE the service level environment config above
+    handler: handler.hello
+    kmsKeyArn: arn:aws:kms:us-east-1:XXXXXX:key/some-hash
+    environment:
+      TABLE_NAME: tableName2
+  goodbye: # this function will INHERIT the service level environment config above
+    handler: handler.goodbye
+    kmsKeyArn: arn:aws:kms:us-east-1:XXXXXX:key/some-hash
diff --git a/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/positive_expected_result.json b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/positive_expected_result.json
index 00e5502184b..1a155e28f03 100644
--- a/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/positive_expected_result.json
+++ b/assets/queries/serverlessFW/serverless_function_environment_variables_not_encrypted/test/positive_expected_result.json
@@ -1,8 +1,20 @@
 [
+  {
+    "queryName": "Serverless Function Environment Variables Not Encrypted",
+    "severity": "HIGH",
+    "line": 6,
+    "fileName": "positive1.yml"
+  },
   {
     "queryName": "Serverless Function Environment Variables Not Encrypted",
     "severity": "HIGH",
     "line": 12,
     "fileName": "positive1.yml"
+  },
+  {
+    "queryName": "Serverless Function Environment Variables Not Encrypted",
+    "severity": "HIGH",
+    "line": 6,
+    "fileName": "positive2.yml"
   }
 ]