Repository: Checkmarx/kics (language: python)

Issue:
Kics complains about a configuration that is not valid.
https://docs.kics.io/latest/queries/terraform-queries/aws/4c3267c9-b2ac-40bf-93f6-b610fb8c7b9f/

refers to a configuration that is not valid for aws_efs_file_system (https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system) terraform resource. There's no such attribute called transit_encryption on that resource. It is however an attribute on aws_ecs_task_definition (https://registry.terraform.io/providers/hashicorp/aws/3.9.0/docs/resources/ecs_task_definition) which is a completely different service.

The check is incorrectly flagging as a vulnerability. The documentation is incorrect as well.


Discussion / hints:

Fix patch:
diff --git a/.github/workflows/validate-tf-samples.yml b/.github/workflows/validate-tf-samples.yml
index 523327e8de7..b997571e5dd 100644
--- a/.github/workflows/validate-tf-samples.yml
+++ b/.github/workflows/validate-tf-samples.yml
@@ -30,4 +30,4 @@ jobs:
             --linter .bin/tflint \
             --skip '.github/scripts/samples-linters/ignore-list/terraform' \
             --verbose --tmp --redirect \
-            --extra '--config .github/scripts/samples-linters/.tflint.hcl'
+            --extra '--config .github/scripts/samples-linters/.tflint.hcl --filter'
diff --git a/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/metadata.json b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/metadata.json
index f8ac68854d2..dd941d163b1 100644
--- a/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/metadata.json
+++ b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/metadata.json
@@ -3,9 +3,9 @@
   "queryName": "ECS Task Definition Volume Not Encrypted",
   "severity": "HIGH",
   "category": "Encryption",
-  "descriptionText": "AWS ECS Task Definition EFS data in transit between AWS ECS host and AWS EFS server should be encrypted",
+  "descriptionText": "Amazon ECS Task Definition does not have encryption for data at transit enabled. To prevent such a scenario, enable the attribute 'transit_encryption'",
   "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition#transit_encryption",
   "platform": "Terraform",
   "descriptionID": "b01e131b",
   "cloudProvider": "aws"
-}
+}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/query.rego b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/query.rego
index f47291d055f..83c25dee5e2 100644
--- a/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/query.rego
+++ b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/query.rego
@@ -42,3 +42,20 @@ CxPolicy[result] {
 		"remediationType": "addition",
 	}
 }
+
+CxPolicy[result] {
+	resource := input.document[i].resource.aws_ecs_task_definition[name]
+	volume := resource.volume
+	not common_lib.valid_key(volume, "efs_volume_configuration")
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": "aws_ecs_task_definition",
+		"resourceName": tf_lib.get_resource_name(resource, name),
+		"searchKey": sprintf("aws_ecs_task_definition[{{%s}}].volume", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "aws_ecs_task_definition", name, "volume"], []),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": "aws_ecs_task_definition.volume.efs_volume_configuration value should be defined",
+		"keyActualValue": "aws_ecs_task_definition.volume.efs_volume_configuration is not set",
+	}
+}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/metadata.json b/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/metadata.json
deleted file mode 100644
index 6098d757a86..00000000000
--- a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/metadata.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-    "id": "4c3267c9-b2ac-40bf-93f6-b610fb8c7b9f",
-    "queryName": "EFS Volume With Disabled Transit Encryption",
-    "severity": "HIGH",
-    "category": "Encryption",
-    "descriptionText": "Amazon EFS volume does not have encryption for data at transit enabled. To prevent such a scenario, enable the attribute 'transit_encryption'",
-    "descriptionUrl": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/efs-volumes.html",
-    "platform": "Terraform",
-    "descriptionID": "f03ca8fb",
-    "cloudProvider": "aws"
-  }
-  
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/query.rego b/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/query.rego
deleted file mode 100644
index d35b622dac0..00000000000
--- a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/query.rego
+++ /dev/null
@@ -1,38 +0,0 @@
-package Cx
-
-import data.generic.common as common_lib
-import data.generic.terraform as tf_lib
-
-CxPolicy[result] {
-	resource := input.document[i].resource.aws_efs_file_system[name]
-	ans := resource.transit_encryption
-	not ans = "ENABLED"
-	
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_efs_file_system",
-		"resourceName": tf_lib.get_resource_name(resource, name),
-		"searchKey": sprintf("aws_efs_file_system[%s].transit_encryption", [name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("aws_efs_file_system[%s].transit_encryption should be set to 'ENABLED'", [name]),
-		"keyActualValue": sprintf("aws_efs_file_system[%s].transit_encryption is set to '%s'", [name, ans]),
-		"searchLine": common_lib.build_search_line(["resource", "aws_efs_file_system", name, "transit_encryption"], []),
-	}
-}
-
-CxPolicy[result] {
-	resource := input.document[i].resource.aws_efs_file_system[name]
-	not resource.transit_encryption	
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_efs_file_system",
-		"resourceName": tf_lib.get_resource_name(resource, name),
-		"searchKey": sprintf("aws_efs_file_system[%s].transit_encryption", [name]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("aws_efs_file_system[%s].transit_encryption should be set to ENABLED", [name]),
-		"keyActualValue": sprintf("aws_efs_file_system[%s].transit_encryption is not set", [name, ]),
-		"searchLine": common_lib.build_search_line(["resource", "aws_efs_file_system", name], []),
-	}
-}
\ No newline at end of file


Test patch:
diff --git a/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive3.tf b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive3.tf
new file mode 100644
index 00000000000..b435750096d
--- /dev/null
+++ b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive3.tf
@@ -0,0 +1,8 @@
+resource "aws_ecs_task_definition" "service_2" {
+  family                = "service"
+  container_definitions = file("task-definitions/service.json")
+
+  volume {
+    name = "service-storage"
+  }
+}
diff --git a/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive_expected_result.json b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive_expected_result.json
index 561c5f58bde..eb31f45586e 100644
--- a/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive_expected_result.json
+++ b/assets/queries/terraform/aws/ecs_task_definition_volume_not_encrypted/test/positive_expected_result.json
@@ -10,5 +10,11 @@
     "severity": "HIGH",
     "line": 8,
     "filename": "positive2.tf"
+  },
+  {
+    "queryName": "ECS Task Definition Volume Not Encrypted",
+    "severity": "HIGH",
+    "line": 5,
+    "filename": "positive3.tf"
   }
 ]
diff --git a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/negative1.tf b/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/negative1.tf
deleted file mode 100644
index 514545049c0..00000000000
--- a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/negative1.tf
+++ /dev/null
@@ -1,21 +0,0 @@
-provider "aws" {
-  region = "us-west-2"
-}
-
-resource "aws_efs_file_system" "example" {
-  creation_token      = "example"
-  transit_encryption = "ENABLED"
-  encrypted           = true
-  performance_mode    = "generalPurpose"
-  throughput_mode     = "bursting"
-
-  tags = {
-    Name = "example-efs"
-  }
-}
-
-resource "aws_efs_mount_target" "example" {
-  file_system_id = aws_efs_file_system.example.id
-  subnet_id      = "subnet-0123456789abcdef0"
-  security_groups = ["sg-0123456789abcdef0"]
-}
diff --git a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive1.tf b/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive1.tf
deleted file mode 100644
index 31d0a0e9a77..00000000000
--- a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive1.tf
+++ /dev/null
@@ -1,21 +0,0 @@
-provider "aws" {
-  region = "us-west-2"
-}
-
-resource "aws_efs_file_system" "example" {
-  creation_token      = "example"
-  transit_encryption = "DISABLED"
-  encrypted           = true
-  performance_mode    = "generalPurpose"
-  throughput_mode     = "bursting"
-
-  tags = {
-    Name = "example-efs"
-  }
-}
-
-resource "aws_efs_mount_target" "example" {
-  file_system_id = aws_efs_file_system.example.id
-  subnet_id      = "subnet-0123456789abcdef0"
-  security_groups = ["sg-0123456789abcdef0"]
-}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive2.tf b/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive2.tf
deleted file mode 100644
index bd80cd929a0..00000000000
--- a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive2.tf
+++ /dev/null
@@ -1,20 +0,0 @@
-provider "aws" {
-  region = "us-west-2"
-}
-
-resource "aws_efs_file_system" "example" {
-  creation_token      = "example"
-  encrypted           = true
-  performance_mode    = "generalPurpose"
-  throughput_mode     = "bursting"
-
-  tags = {
-    Name = "example-efs"
-  }
-}
-
-resource "aws_efs_mount_target" "example" {
-  file_system_id = aws_efs_file_system.example.id
-  subnet_id      = "subnet-0123456789abcdef0"
-  security_groups = ["sg-0123456789abcdef0"]
-}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive_expected_result.json b/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive_expected_result.json
deleted file mode 100644
index ee3179ca724..00000000000
--- a/assets/queries/terraform/aws/efs_volume_with_disabled_transit_encryption/test/positive_expected_result.json
+++ /dev/null
@@ -1,15 +0,0 @@
-[
-  {
-    "queryName": "EFS Volume With Disabled Transit Encryption",
-    "severity": "HIGH",
-    "line": 7,
-    "fileName": "positive1.tf"
-  },
-  {
-    "queryName": "EFS Volume With Disabled Transit Encryption",
-    "severity": "HIGH",
-    "line": 5,
-    "fileName": "positive2.tf"
-  }
-]
-  
\ No newline at end of file