Repository: Checkmarx/kics (language: python)

Issue:
bug(terraform): terraform s3 mfa delete flagged as high sev
The terraform query for creating an s3 bucket without MFA delete enabled is flagged as HIGH severity.

https://docs.kics.io/latest/queries/terraform-queries/aws/c5b31ab9-0f26-4a49-b8aa-4cc064392f4d/

I feel this is an error and consensus among my peers in AWS Platform Teams, is generally the absence of MFA delete isn't a vulnerability nor insecurity, but something indicated only for very specific datasets, if the data has critical retention requirements.

The problem this caused for us, being classified for all buckets as High severity, the security team who do not have this context are now looking to - across the platform - either require MFA delete on everything, or require exemptions, when really enabling MFA delete should be the exception not the rule.

Additionally, over-classifying queries increases alert fatigue and unnecessarily increases reported vulnerability level of systems; decreases the effectiveness and usefulness of KICS scans.

My recommendation is to keep the check - it is a valuable prompt or consideration - but downgrade severity to only INFO.

If we agree, happy to submit PR for this https://github.com/Checkmarx/kics/blob/bc0b22cbdc5c0c107d64ac9566af003c6368742f/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/metadata.json#L4C22-L4C22


Discussion / hints:
Hi @rdkls ,

Thank you for your inputs!
Our AppSec team is checking the situation and we will give you more feedback asap.

(APPSEC-2332)

Fix patch:
diff --git a/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/metadata.json b/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/metadata.json
index 7557b845e86..706dc87b008 100755
--- a/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/metadata.json
+++ b/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/metadata.json
@@ -1,7 +1,7 @@
 {
   "id": "c5b31ab9-0f26-4a49-b8aa-4cc064392f4d",
   "queryName": "S3 Bucket Without Enabled MFA Delete",
-  "severity": "HIGH",
+  "severity": "LOW",
   "category": "Insecure Configurations",
   "descriptionText": "S3 bucket without MFA Delete Enabled. MFA delete cannot be enabled through Terraform, it can be done by adding a MFA device (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html) and enabling versioning and MFA delete by using AWS CLI: 'aws s3api put-bucket-versioning --versioning-configuration=Status=Enabled,MFADelete=Enabled --bucket=\u003cBUCKET_NAME\u003e --mfa=\u003cMFA_SERIAL_NUMBER\u003e'. Please, also notice that MFA delete can not be used with lifecycle configurations",
   "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#mfa_delete",


Test patch:
diff --git a/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/test/positive_expected_result.json b/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/test/positive_expected_result.json
index 3dfb90b33a0..46f89917c14 100755
--- a/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/test/positive_expected_result.json
+++ b/assets/queries/terraform/aws/s3_bucket_without_enabled_mfa_delete/test/positive_expected_result.json
@@ -1,74 +1,74 @@
 [
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 14,
     "fileName": "positive1.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 23,
     "fileName": "positive2.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 25,
     "fileName": "positive3.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 24,
     "fileName": "positive4.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 23,
     "fileName": "positive4.tf"
   },
   
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 1,
     "fileName": "positive5.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 8,
     "fileName": "positive6.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 10,
     "fileName": "positive7.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 8,
     "fileName": "positive8.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 9,
     "fileName": "positive8.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 28,
     "fileName": "positive9.tf"
   },
   {
     "queryName": "S3 Bucket Without Enabled MFA Delete",
-    "severity": "HIGH",
+    "severity": "LOW",
     "line": 27,
     "fileName": "positive10.tf"
   }