Repository: Checkmarx/kics (language: python)

Issue:
query(all): deprecate "S3 Bucket SSE Disabled"
Given AWS's [recent change](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html) to encrypt all new S3 objects, the queries for "S3 Bucket SSE Disabled" seem unneeded

* `assets/queries/ansible/aws/s3_bucket_sse_disabled`
* `assets/queries/cloudFormation/aws/s3_bucket_sse_disabled`
* `assets/queries/terraform/aws/s3_bucket_sse_disabled`
bug(cloudformation): s3 bucket setup with KMS managed encryption w/o KMS key yields `S3 Bucket SSE Disabled`
Hi there, let me know what you think? 

I figure I'm missing something, or, the issue should be removed / severity reduced for this particular scenario. In other words, AWS forces encryption if a key is omitted.

The query that relates to this is https://docs.kics.io/latest/queries/cloudformation-queries/aws/64ab651b-f5b2-4af0-8c89-ddd03c4d0e61/.

### Expected Behavior

Not a high severity issue, at least, in this particular case. For now I've excluded the query.

Why? If you don't specify a KMS key at configuration, AWS automatically adds one. ([ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-serversideencryptionbydefault.html#:~:text=If%20you%20don%27t%20specify%20a%20customer%20managed%20key%20at%20configuration%2C%20Amazon%20S3%20automatically%20creates%20an%20AWS%20KMS%20key%20in%20your%20AWS%20account%20the%20first%20time%20that%20you%20add%20an%20object%20encrypted%20with%20SSE%2DKMS%20to%20a%20bucket.))

### Actual Behavior

The issue is classified as High severity

### Steps to Reproduce the Problem

1. Given CF to create a bucket like:

```json
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
      "MyS3Bucket": {
        "Type": "AWS::S3::Bucket",
        "Properties": {
          "BucketEncryption": {
            "ServerSideEncryptionConfiguration": [
              {
                "ServerSideEncryptionByDefault": {
                  "SSEAlgorithm": "aws:kms"
                },
                "BucketKeyEnabled": false
              }
            ]
          }
        }
      }
    }
  }
```

2. The AWS CLI will can be used to check for encryption `aws s3api get-bucket-encryption --bucket <bucket-name>` and returns:

```json
{
    "ServerSideEncryptionConfiguration": {
        "Rules": [
            {
                "ApplyServerSideEncryptionByDefault": {
                    "SSEAlgorithm": "aws:kms"
                },
                "BucketKeyEnabled": false
            }
        ]
    }
}
```

3. Scan it with KICS, you should be back something like the following in the result file:

To scan it:
```sh
docker run -t -v ./:/path checkmarx/kics:latest scan -t CloudFormation -p /path -o "/path/"         --fail-on=high --exclude-severities=low,info,medium --exclude-paths=/path/*canonical* --log-level=DEBUG
```

```json
{
	"file_name": "../../path/foo-brick.template.json",
	"similarity_id": "00a648b0c2facda223d98136e0519c9c21830a79fe5d8c1414052657f8fc3d19",
	"line": 4212,
	"resource_type": "AWS::S3::Bucket",
	"resource_name": "brickservice",
	"issue_type": "IncorrectValue",
	"search_key": "Resources.brickservice.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm",
	"search_line": -1,
	"search_value": "",
	"expected_value": "Resources.brickservice.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm is 'AES256'",
	"actual_value": "Resources.brickservice.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm is 'aws:kms'"
}
```

### Specifications
(N/A if not applicable)

-   Version: `Keeping Infrastructure as Code Secure v1.7.13`
-   Platform: `Ubuntu 22.04.3 LTS`
-   Subsystem: n/a



Discussion / hints:
I agree, this is a message that I'll always dismiss as a false-positive
Hi @Tohar-orca @joshsizer ,

Thanks for your feedback! Our AppSec team is analyzing it. We will give you our feedback as soon as we get the info from AppSec team.
Hi @Tohar-orca @joshsizer ,

Our internal AppSec team provided the following feedback:

_This change will indeed bring default encryption for Amazon S3 new objects. Anyway, if we look at the [shared documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html), existing unencrypted buckets and objects will not be changed._

_Is default encryption enabled on my existing buckets that don't have default encryption configured?_

_Yes. Amazon S3 now configures default encryption on all existing unencrypted buckets to apply server-side encryption with S3 managed keys (SSE-S3) as the base level of encryption for new objects uploaded to these buckets. Objects that are already in an existing unencrypted bucket won't be automatically encrypted._

_Will Amazon S3 encrypt my existing objects that are unencrypted?_

_No. Beginning on January 5, 2023, Amazon S3 only automatically encrypts new object uploads. To encrypt existing objects, you can use S3 Batch Operations to create encrypted copies of your objects._

**_With this in mind, I recommend that we make some changes in our query (if feasible) to simply identify the S3 and objects that are configured without SSE._**

Since our AppSec team recommends to "make some changes in our query", means their perspective is to not deprecate the following queries for now:

- assets/queries/ansible/aws/s3_bucket_sse_disabled
- assets/queries/cloudFormation/aws/s3_bucket_sse_disabled
- assets/queries/terraform/aws/s3_bucket_sse_disabled

What is your perspective on this?


Thanks for the response, @gabriel-cx 

The way I read the AWS response on S3 default encryption, it would appear that static analysis of S3 buckets cannot indicate if an S3 bucket has unencrypted objects in it.

All buckets, created **before** or **after** January 5, 2023, will have SSE enabled. Therefore, the `SSE Bucket SSE Disabled` finding will _never be true_.

From [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html#:~:text=can%20i%20disable%20encryption):

> Can I disable encryption for the new objects being written to my bucket?
> 
> No. SSE-S3 is the new base level of encryption that's applied to all the new objects being uploaded to your bucket. You can no longer disable encryption for new object uploads.

Based on this information, I don't believe there is a case in configuration where S3 buckets will not have encryption enabled, and therefore the warning `SSE Bucket SSE Disabled` will always be a false positive.

As an example using Terraform, currently to resolve this finding, one must add [aws_s3_bucket_server_side_encryption_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration#apply_server_side_encryption_by_default). In regards to security, this block is uneeded, since S3 buckets have an implicit S3-SSE encryption enabled by default for all current and new buckets. As a user of kics, I find it cumbersome to have to either add this configuration block (which doesn't materially improve data security), or dismiss the finding manually.
@joshsizer thank you for your feedback again on this!

I opened a ticket so our AppSec team can give us feedback regarding your perspective. I will update you as soon as i get the information.

(APPSEC-2341)


Fix patch:
diff --git a/assets/queries/ansible/aws/s3_bucket_sse_disabled/metadata.json b/assets/queries/ansible/aws/s3_bucket_sse_disabled/metadata.json
deleted file mode 100644
index 35720541050..00000000000
--- a/assets/queries/ansible/aws/s3_bucket_sse_disabled/metadata.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "id": "309edc5b-5a59-42b4-a357-d4d098311fd4",
-  "queryName": "S3 Bucket SSE Disabled",
-  "severity": "HIGH",
-  "category": "Encryption",
-  "descriptionText": "If the master key is null, empty, or undefined, then the SSE algorithm should be AES256. Conversely, if the SSE algorithm is AES256, then the master key should be null, empty, or undefined.",
-  "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/amazon/aws/s3_bucket_module.html#parameter-encryption_key_id",
-  "platform": "Ansible",
-  "descriptionID": "4008dca4",
-  "cloudProvider": "aws",
-  "cwe": ""
-}
\ No newline at end of file
diff --git a/assets/queries/ansible/aws/s3_bucket_sse_disabled/query.rego b/assets/queries/ansible/aws/s3_bucket_sse_disabled/query.rego
deleted file mode 100644
index a866097963a..00000000000
--- a/assets/queries/ansible/aws/s3_bucket_sse_disabled/query.rego
+++ /dev/null
@@ -1,44 +0,0 @@
-package Cx
-
-import data.generic.ansible as ansLib
-import data.generic.common as commonLib
-
-modules := {"amazon.aws.s3_bucket", "s3_bucket"}
-
-CxPolicy[result] {
-	task := ansLib.tasks[id][t]
-	s3_bucket := task[modules[m]]
-	ansLib.checkState(s3_bucket)
-
-	s3_bucket.encryption != "AES256"
-	not s3_bucket.encryption_key_id
-
-	result := {
-		"documentId": id,
-		"resourceType": modules[m],
-		"resourceName": task.name,
-		"searchKey": sprintf("name={{%s}}.{{%s}}.encryption", [task.name, modules[m]]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": "s3_bucket.encryption_key_id should be defined",
-		"keyActualValue": "s3_bucket.encryption_key_id is undefined",
-	}
-}
-
-CxPolicy[result] {
-	task := ansLib.tasks[id][t]
-	s3_bucket := task[modules[m]]
-	ansLib.checkState(s3_bucket)
-
-	s3_bucket.encryption != "AES256"
-	commonLib.emptyOrNull(s3_bucket.encryption_key_id)
-
-	result := {
-		"documentId": id,
-		"resourceType": modules[m],
-		"resourceName": task.name,
-		"searchKey": sprintf("name={{%s}}.{{%s}}.encryption", [task.name, modules[m]]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": "s3_bucket.encryption_key_id should be defined",
-		"keyActualValue": "s3_bucket.encryption_key_id is empty or null",
-	}
-}
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/metadata.json b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/metadata.json
deleted file mode 100644
index b38e925061e..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/metadata.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "id": "64ab651b-f5b2-4af0-8c89-ddd03c4d0e61",
-  "queryName": "S3 Bucket SSE Disabled",
-  "severity": "HIGH",
-  "category": "Encryption",
-  "descriptionText": "If the master key is null, empty, or undefined, then the SSE algorithm should be AES256. Conversely, if the SSE algorithm is AES256, then the master key should be null, empty, or undefined.",
-  "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-serversideencryptionbydefault.html",
-  "platform": "CloudFormation",
-  "descriptionID": "42fd2930",
-  "cloudProvider": "aws",
-  "cwe": ""
-}
\ No newline at end of file
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/query.rego b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/query.rego
deleted file mode 100644
index 820eb86406f..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/query.rego
+++ /dev/null
@@ -1,121 +0,0 @@
-package Cx
-
-import data.generic.common as common_lib
-import data.generic.cloudformation as cf_lib
-
-# return every bucket as result if there are no policies defined
-CxPolicy[result] {
-	document := input.document[i]
-	resources := document.Resources
-	some resource
-	resources[resource].Type == "AWS::S3::Bucket"
-
-	bucket := resources[resource].Properties
-
-	not common_lib.valid_key(bucket,"BucketEncryption")
-
-	result := {
-		"documentId": document.id,
-		"resourceType": resources[resource].Type,
-		"resourceName": cf_lib.get_resource_name(resources[resource], resource),
-		"searchKey": sprintf("Resources.%s.Properties", [resource]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("Resources.%s.Properties.BucketEncryption should be set", [resource]),
-		"keyActualValue": sprintf("Resources.%s.Properties.BucketEncryption is undefined", [resource]),
-	}
-}
-
-CxPolicy[result] {
-	document := input.document[i]
-	resources := document.Resources
-	some resource
-	resources[resource].Type == "AWS::S3::Bucket"
-
-	bucket := resources[resource].Properties
-
-    serverEncryption := bucket.BucketEncryption.ServerSideEncryptionConfiguration
-	not hasServerEncryptionRules(serverEncryption)
-
-	result := {
-		"documentId": document.id,
-		"resourceType": resources[resource].Type,
-		"resourceName": cf_lib.get_resource_name(resources[resource], resource),
-		"searchKey": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration", [resource]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration has at least one ServerSideEncryptionByDefault rule", [resource]),
-		"keyActualValue": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration does not have a ServerSideEncryptionByDefault rule", [resource]),
-	}
-}
-
-CxPolicy[result] {
-	document := input.document[i]
-	resources := document.Resources
-	some resource
-	resources[resource].Type == "AWS::S3::Bucket"
-
-	bucket := resources[resource].Properties
-
-    serverEncryption := bucket.BucketEncryption.ServerSideEncryptionConfiguration
-	hasServerEncryptionRules(serverEncryption)
-
-    some j
-    serverRule := serverEncryption[j].ServerSideEncryptionByDefault
-
-    checkMasterKey(serverRule)
-    not serverRule.SSEAlgorithm == "AES256"
-
-	result := {
-		"documentId": document.id,
-		"resourceType": resources[resource].Type,
-		"resourceName": cf_lib.get_resource_name(resources[resource], resource),
-		"searchKey": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm", [resource]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm is 'AES256'", [resource]),
-		"keyActualValue": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm is '%s'", [resource,serverRule.SSEAlgorithm]),
-	}
-}
-
-CxPolicy[result] {
-	document := input.document[i]
-	resources := document.Resources
-	some resource
-	resources[resource].Type == "AWS::S3::Bucket"
-
-	bucket := resources[resource].Properties
-
-    serverEncryption := bucket.BucketEncryption.ServerSideEncryptionConfiguration
-	hasServerEncryptionRules(serverEncryption)
-
-    some j
-    serverRule := serverEncryption[j].ServerSideEncryptionByDefault
-
-    not checkMasterKey(serverRule)
-    serverRule.SSEAlgorithm == "AES256"
-
-	result := {
-		"documentId": document.id,
-		"resourceType": resources[resource].Type,
-		"resourceName": cf_lib.get_resource_name(resources[resource], resource),
-		"searchKey": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.KMSMasterKeyID", [resource]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.KMSMasterKeyID should be undefined", [resource]),
-		"keyActualValue": sprintf("Resources.%s.Properties.BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.KMSMasterKeyID is set", [resource]),
-	}
-}
-
-hasServerEncryptionRules(list) {
-    some i
-    common_lib.valid_key(list[i],"ServerSideEncryptionByDefault")
-}
-
-checkMasterKey(assed) {
-	not common_lib.valid_key(assed, "KMSMasterKeyID")
-}
-
-checkMasterKey(assed) {
-	assed.KMSMasterKeyID == ""
-}
-
-checkMasterKey(assed) {
-	assed.KMSMasterKeyID == null
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/metadata.json b/assets/queries/terraform/aws/s3_bucket_sse_disabled/metadata.json
deleted file mode 100644
index b76093eda2c..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/metadata.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "id": "6726dcc0-5ff5-459d-b473-a780bef7665c",
-  "queryName": "S3 Bucket SSE Disabled",
-  "severity": "HIGH",
-  "category": "Encryption",
-  "descriptionText": "If the master key is null, empty, or undefined, then the SSE algorithm should be AES256. Conversely, if the SSE algorithm is AES256, then the master key should be null, empty, or undefined.",
-  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#server_side_encryption_configuration",
-  "platform": "Terraform",
-  "descriptionID": "b386c506",
-  "cloudProvider": "aws",
-  "cwe": ""
-}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/query.rego b/assets/queries/terraform/aws/s3_bucket_sse_disabled/query.rego
deleted file mode 100644
index 43b4cb0acd9..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/query.rego
+++ /dev/null
@@ -1,203 +0,0 @@
-package Cx
-
-import data.generic.common as common_lib
-import data.generic.terraform as tf_lib
-
-# version before TF AWS 4.0
-CxPolicy[result] {
-	bucket := input.document[i].resource.aws_s3_bucket[name]
-	sse := bucket.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default
-
-	check_master_key(sse)
-	sse.sse_algorithm != "AES256"
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_s3_bucket",
-		"resourceName": tf_lib.get_specific_resource_name(bucket, "aws_s3_bucket", name),
-		"searchKey": sprintf("aws_s3_bucket[%s].server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", [name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'sse_algorithm' should be AES256 when key is null",
-		"keyActualValue": sprintf("'sse_algorithm' is %s when key is null", [sse.sse_algorithm]),
-		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket", name, "server_side_encryption_configuration", "rule", "apply_server_side_encryption_by_default", "sse_algorithm"], []),
-	}
-}
-
-CxPolicy[result] {
-	module := input.document[i].module[name]
-	keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_s3_bucket", "server_side_encryption_configuration")
-
-	ssec := module[keyToCheck]
-	algorithm := ssec.rule.apply_server_side_encryption_by_default
-
-	check_master_key(algorithm)
-	algorithm.sse_algorithm != "AES256"
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "n/a",
-		"resourceName": "n/a",
-		"searchKey": sprintf("module[%s].server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", [name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'sse_algorithm' should be AES256 when key is null",
-		"keyActualValue": sprintf("'sse_algorithm' is %s when key is null", [algorithm.sse_algorithm]),
-		"searchLine": common_lib.build_search_line(["module", name, "server_side_encryption_configuration", "rule", "apply_server_side_encryption_by_default", "sse_algorithm"], []),
-	}
-}
-
-# version before TF AWS 4.0
-CxPolicy[result] {
-	resource := input.document[i].resource.aws_s3_bucket[name]
-	ssec := resource.server_side_encryption_configuration
-	algorithm := ssec.rule.apply_server_side_encryption_by_default
-
-	not check_master_key(algorithm)
-	algorithm.sse_algorithm == "AES256"
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_s3_bucket",
-		"resourceName": tf_lib.get_specific_resource_name(resource, "aws_s3_bucket", name),
-		"searchKey": sprintf("aws_s3_bucket[%s].server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id", [name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'kms_master_key_id' should be null when algorithm is 'AES256'",
-		"keyActualValue": "'kms_master_key_id'is not null when algorithm is 'AES256'",
-		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket", name, "server_side_encryption_configuration", "rule", "apply_server_side_encryption_by_default", "kms_master_key_id"], []),
-	}
-}
-
-CxPolicy[result] {
-	module := input.document[i].module[name]
-	keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_s3_bucket", "server_side_encryption_configuration")
-
-	ssec := module[keyToCheck]
-	algorithm := ssec.rule.apply_server_side_encryption_by_default
-
-	not check_master_key(algorithm)
-	algorithm.sse_algorithm == "AES256"
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "n/a",
-		"resourceName": "n/a",
-		"searchKey": sprintf("module[%s].server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id", [name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'kms_master_key_id' should be null when algorithm is 'AES256'",
-		"keyActualValue": "'kms_master_key_id'is not null when algorithm is 'AES256'",
-		"searchLine": common_lib.build_search_line(["module", name, "server_side_encryption_configuration", "rule", "apply_server_side_encryption_by_default", "kms_master_key_id"], []),
-	}
-}
-
-CxPolicy[result] {
-	module := input.document[i].module[name]
-	keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_s3_bucket", "server_side_encryption_configuration")
-
-	not common_lib.valid_key(module, keyToCheck)
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "n/a",
-		"resourceName": "n/a",
-		"searchKey": sprintf("module[%s]", [name]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": "'server_side_encryption_configuration' should be defined and not null",
-		"keyActualValue": "'server_side_encryption_configuration' is undefined or null",
-		"searchLine": common_lib.build_search_line(["module", name], []),
-	}
-}
-
-CxPolicy[result] {
-	bucket := input.document[i].resource.aws_s3_bucket[bucketName]
-
-	not is_associated(bucketName, input.document[i])
-	not tf_lib.has_target_resource(bucketName, "aws_s3_bucket_server_side_encryption_configuration") # version after TF AWS 4.0
-	not common_lib.valid_key(bucket, "server_side_encryption_configuration") # version before TF AWS 4.0
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_s3_bucket",
-		"resourceName": tf_lib.get_specific_resource_name(bucket, "aws_s3_bucket", bucketName),
-		"searchKey": sprintf("aws_s3_bucket[%s]", [bucketName]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": "'aws_s3_bucket' to have 'server_side_encryption_configuration' associated",
-		"keyActualValue": "'aws_s3_bucket' does not have 'server_side_encryption_configuration' associated",
-		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket", bucketName], []),
-	}
-}
-
-# version after TF AWS 4.0
-CxPolicy[result] {
-	input.document[_].resource.aws_s3_bucket[bucketName]
-
-	sse := input.document[i].resource.aws_s3_bucket_server_side_encryption_configuration[name]
-	split(sse.bucket, ".")[1] == bucketName
-	not common_lib.valid_key(sse.rule, "apply_server_side_encryption_by_default")
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_s3_bucket_server_side_encryption_configuration",
-		"resourceName": tf_lib.get_resource_name(sse, name),
-		"searchKey": sprintf("aws_s3_bucket_server_side_encryption_configuration[%s].rule", [name]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": "'apply_server_side_encryption_by_default' should be defined and not null",
-		"keyActualValue": "'apply_server_side_encryption_by_default' is undefined or null",
-		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket_server_side_encryption_configuration", name, "rule"], []),
-	}
-}
-
-# version after TF AWS 4.0
-CxPolicy[result] {
-	input.document[_].resource.aws_s3_bucket[bucketName]
-
-	sse := input.document[i].resource.aws_s3_bucket_server_side_encryption_configuration[name]
-	split(sse.bucket, ".")[1] == bucketName
-	algorithm := sse.rule.apply_server_side_encryption_by_default
-	not check_master_key(algorithm)
-	algorithm.sse_algorithm == "AES256"
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_s3_bucket_server_side_encryption_configuration",
-		"resourceName": tf_lib.get_resource_name(sse, name),
-		"searchKey": sprintf("aws_s3_bucket_server_side_encryption_configuration[%s].rule.apply_server_side_encryption_by_default.kms_master_key_id", [name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'kms_master_key_id' should be null when algorithm is 'AES256'",
-		"keyActualValue": "'kms_master_key_id' is not null when algorithm is 'AES256'",
-		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket_server_side_encryption_configuration", name, "rule", "apply_server_side_encryption_by_default", "kms_master_key_id"], []),
-	}
-}
-
-# version after TF AWS 4.0
-CxPolicy[result] {
-	input.document[_].resource.aws_s3_bucket[bucketName]
-
-	sse := input.document[i].resource.aws_s3_bucket_server_side_encryption_configuration[name]
-	split(sse.bucket, ".")[1] == bucketName
-
-	rule := sse.rule.apply_server_side_encryption_by_default
-	check_master_key(rule)
-	rule.sse_algorithm != "AES256"
-
-	result := {
-		"documentId": input.document[i].id,
-		"resourceType": "aws_s3_bucket_server_side_encryption_configuration",
-		"resourceName": tf_lib.get_resource_name(sse, name),
-		"searchKey": sprintf("aws_s3_bucket_server_side_encryption_configuration[%s].rule.apply_server_side_encryption_by_default.sse_algorithm", [name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": "'sse_algorithm' should be AES256 when key is null",
-		"keyActualValue": sprintf("'sse_algorithm' is %s when key is null", [rule.sse_algorithm]),
-		"searchLine": common_lib.build_search_line(["resource", "aws_s3_bucket_server_side_encryption_configuration", name, "rule", "apply_server_side_encryption_by_default", "sse_algorithm"], []),
-	}
-}
-
-check_master_key(assed) {
-	not common_lib.valid_key(assed, "kms_master_key_id")
-} else {
-	common_lib.emptyOrNull(assed.kms_master_key_id)
-}
-
-is_associated(aws_s3_bucket_name, doc) {
-	[_, value] := walk(doc)
-	sse_configurations := value.aws_s3_bucket_server_side_encryption_configuration[_]
-	contains(sse_configurations.bucket, sprintf("aws_s3_bucket.%s", [aws_s3_bucket_name]))
-}


Test patch:
diff --git a/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/negative.yaml b/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/negative.yaml
deleted file mode 100644
index 74f20523782..00000000000
--- a/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/negative.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-- name: mys3Bucket
-  amazon.aws.s3_bucket:
-    name: mys3bucket
-    state: present
-    encryption: AES256
diff --git a/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/positive.yaml b/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/positive.yaml
deleted file mode 100644
index 09a2ff5114c..00000000000
--- a/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/positive.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-- name: mys3Bucket
-  amazon.aws.s3_bucket:
-      name: mys3bucket
-      state: present
-      encryption: "aws:kms"
diff --git a/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/positive_expected_result.json b/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/positive_expected_result.json
deleted file mode 100644
index 2d193c39c62..00000000000
--- a/assets/queries/ansible/aws/s3_bucket_sse_disabled/test/positive_expected_result.json
+++ /dev/null
@@ -1,7 +0,0 @@
-[
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 6
-  }
-]
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/negative.json b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/negative.json
deleted file mode 100644
index 08a65b7b8bf..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/negative.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "AWSTemplateFormatVersion": "2010-09-09",
-  "Description": "S3 bucket with default encryption",
-  "Resources": {
-      "EncryptedS3Bucket": {
-          "Type": "AWS::S3::Bucket",
-          "Properties": {
-              "BucketName": {
-                  "Fn::Sub": "encryptedbucket-${AWS::Region}-${AWS::AccountId}"
-              },
-              "BucketEncryption": {
-                  "ServerSideEncryptionConfiguration": [
-                      {
-                          "ServerSideEncryptionByDefault": {
-                              "SSEAlgorithm": "aws:kms",
-                              "KMSMasterKeyID": "KMS-KEY-ARN"
-                          }
-                      }
-                  ]
-              }
-          },
-          "DeletionPolicy": "Delete"
-      }
-  }
-}
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/negative.yaml b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/negative.yaml
deleted file mode 100644
index 997c78cac61..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/negative.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-Description: S3 bucket with default encryption
-Resources:
-  EncryptedS3Bucket:
-    Type: 'AWS::S3::Bucket'
-    Properties:
-      BucketName:
-        'Fn::Sub': 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
-      BucketEncryption:
-        ServerSideEncryptionConfiguration:
-          - ServerSideEncryptionByDefault:
-              SSEAlgorithm: 'aws:kms'
-              KMSMasterKeyID: KMS-KEY-ARN
-    DeletionPolicy: Delete
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive1.json b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive1.json
deleted file mode 100644
index a2c5b2fa617..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive1.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "AWSTemplateFormatVersion": "2010-09-09",
-  "Description": "S3 bucket with default encryption",
-  "Resources": {
-      "EncryptedS3Bucket": {
-          "Type": "AWS::S3::Bucket",
-          "Properties": {
-              "BucketName": {
-                  "Fn::Sub": "encryptedbucket-${AWS::Region}-${AWS::AccountId}"
-              },
-              "BucketEncryption": {
-                  "ServerSideEncryptionConfiguration": [
-                      {
-                          "ServerSideEncryptionByDefault": {
-                              "SSEAlgorithm": "aws:kms"
-                          }
-                      }
-                  ]
-              }
-          },
-          "DeletionPolicy": "Delete"
-      }
-  }
-}
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive1.yaml b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive1.yaml
deleted file mode 100644
index 27d2c9ff2b3..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive1.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-Description: S3 bucket with default encryption
-Resources:
-  EncryptedS3Bucket:
-    Type: 'AWS::S3::Bucket'
-    Properties:
-      BucketName:
-        'Fn::Sub': 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
-      BucketEncryption:
-        ServerSideEncryptionConfiguration:
-          - ServerSideEncryptionByDefault:
-              SSEAlgorithm: 'aws:kms'
-    DeletionPolicy: Delete
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive2.json b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive2.json
deleted file mode 100644
index d90e7f51b2c..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive2.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "AWSTemplateFormatVersion": "2010-09-09",
-  "Description": "S3 bucket with default encryption",
-  "Resources": {
-      "EncryptedS3Bucket": {
-          "Type": "AWS::S3::Bucket",
-          "Properties": {
-              "BucketName": {
-                  "Fn::Sub": "encryptedbucket-${AWS::Region}-${AWS::AccountId}"
-              },
-              "BucketEncryption": {
-                  "ServerSideEncryptionConfiguration": [
-                      {
-                          "ServerSideEncryptionByDefault": {
-                              "SSEAlgorithm": "AES256",
-                              "KMSMasterKeyID": "KMS-KEY-ARN"
-                          }
-                      }
-                  ]
-              }
-          },
-          "DeletionPolicy": "Delete"
-      }
-  }
-}
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive2.yaml b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive2.yaml
deleted file mode 100644
index 13d0735578a..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive2.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-AWSTemplateFormatVersion: '2010-09-09'
-Description: S3 bucket with default encryption
-Resources:
-  EncryptedS3Bucket:
-    Type: 'AWS::S3::Bucket'
-    Properties:
-      BucketName:
-        'Fn::Sub': 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
-      BucketEncryption:
-        ServerSideEncryptionConfiguration:
-          - ServerSideEncryptionByDefault:
-              SSEAlgorithm: 'AES256'
-              KMSMasterKeyID: KMS-KEY-ARN
-    DeletionPolicy: Delete
diff --git a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive_expected_result.json b/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive_expected_result.json
deleted file mode 100644
index 859c82fafe7..00000000000
--- a/assets/queries/cloudFormation/aws/s3_bucket_sse_disabled/test/positive_expected_result.json
+++ /dev/null
@@ -1,26 +0,0 @@
-[
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 12,
-    "fileName": "positive1.yaml"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 15,
-    "fileName": "positive1.json"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 13,
-    "fileName": "positive2.yaml"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 16,
-    "fileName": "positive2.json"
-  }
-]
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative1.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative1.tf
deleted file mode 100644
index e4c43defe58..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative1.tf
+++ /dev/null
@@ -1,35 +0,0 @@
-provider "aws" {
-  region = "us-east-1"
-}
-
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 3.0"
-    }
-  }
-}
-
-resource "aws_s3_bucket" "negative1" {
-  bucket = "my-tf-test-bucket"
-  acl    = "private"
-
-  tags = {
-    Name        = "My bucket"
-    Environment = "Dev"
-  }
-
-  server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        kms_master_key_id = aws_kms_key.mykey.arn
-        sse_algorithm     = "aws:kms"
-      }
-    }
-  }
-
-  versioning {
-    mfa_delete = true
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative2.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative2.tf
deleted file mode 100644
index bdba45d6587..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative2.tf
+++ /dev/null
@@ -1,20 +0,0 @@
-module "s3_bucket" {
-  source = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.7.0"
-
-  bucket = "my-s3-bucket"
-  acl    = "private"
-
-  versioning = {
-    enabled = true
-  }
-
-   server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        kms_master_key_id = aws_kms_key.mykey.arn
-        sse_algorithm     = "aws:kms"
-      }
-    }
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative3.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative3.tf
deleted file mode 100644
index 2b438620373..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative3.tf
+++ /dev/null
@@ -1,27 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-      version = "4.2.0"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-
-resource "aws_s3_bucket" "mybucket" {
-  bucket = "my-tf-example-bucket"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
-  bucket = aws_s3_bucket.mybucket.bucket
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.mykey.arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative4.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative4.tf
deleted file mode 100644
index c140d17eba2..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/negative4.tf
+++ /dev/null
@@ -1,28 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "4.2.0"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-
-resource "aws_s3_bucket" "mybucket22" {
-  count  = 1
-  bucket = "my-tf-example-bucket"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "example33" {
-  count  = 1
-  bucket = aws_s3_bucket.mybucket22[count.index].bucket
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive1.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive1.tf
deleted file mode 100644
index d871bd767a2..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive1.tf
+++ /dev/null
@@ -1,26 +0,0 @@
-provider "aws" {
-  region = "us-east-1"
-}
-
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 3.0"
-    }
-  }
-}
-
-resource "aws_s3_bucket" "positive1" {
-  bucket = "my-tf-test-bucket"
-  acl    = "private"
-
-  tags = {
-    Name        = "My bucket"
-    Environment = "Dev"
-  }
-
-  versioning {
-    mfa_delete = true
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive10.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive10.tf
deleted file mode 100644
index c7520e00dc0..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive10.tf
+++ /dev/null
@@ -1,24 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-      version = "4.2.0"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-
-resource "aws_s3_bucket" "mybucket22" {
-  bucket = "my-tf-example-bucket"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "example33" {
-  bucket = aws_s3_bucket.mybucket22.bucket
-
-  rule {
-    bucket_key_enabled = false
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive2.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive2.tf
deleted file mode 100644
index 3cc4d29a9c9..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive2.tf
+++ /dev/null
@@ -1,35 +0,0 @@
-provider "aws" {
-  region = "us-east-1"
-}
-
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 3.0"
-    }
-  }
-}
-
-resource "aws_s3_bucket" "positive1" {
-  bucket = "my-tf-test-bucket"
-  acl    = "private"
-
-  tags = {
-    Name        = "My bucket"
-    Environment = "Dev"
-  }
-
-  server_side_encryption_configuration  {
-    rule  {
-      apply_server_side_encryption_by_default  {
-        kms_master_key_id = "some-key"
-        sse_algorithm     = "AES256"
-      }
-    }
-  }
-
-  versioning {
-    mfa_delete = true
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive3.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive3.tf
deleted file mode 100644
index 2120d30031a..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive3.tf
+++ /dev/null
@@ -1,34 +0,0 @@
-provider "aws" {
-  region = "us-east-1"
-}
-
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 3.0"
-    }
-  }
-}
-
-resource "aws_s3_bucket" "positive1" {
-  bucket = "my-tf-test-bucket"
-  acl    = "private"
-
-  tags = {
-    Name        = "My bucket"
-    Environment = "Dev"
-  }
-
-  server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        sse_algorithm     = "aws:kms"
-      }
-    }
-  }
-  
-  versioning {
-    mfa_delete = true
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive4.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive4.tf
deleted file mode 100644
index 5521126f00c..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive4.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-module "s3_bucket" {
-  source = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.7.0"
-
-  bucket = "my-s3-bucket"
-  acl    = "private"
-
-  versioning = {
-    enabled = true
-  }
-
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive5.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive5.tf
deleted file mode 100644
index 76d6e687f3b..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive5.tf
+++ /dev/null
@@ -1,20 +0,0 @@
-module "s3_bucket" {
-  source = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.7.0"
-
-  bucket = "my-s3-bucket"
-  acl    = "private"
-
-  versioning = {
-    enabled = true
-  }
-
-  server_side_encryption_configuration  {
-    rule  {
-      apply_server_side_encryption_by_default  {
-        kms_master_key_id = "some-key"
-        sse_algorithm     = "AES256"
-      }
-    }
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive6.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive6.tf
deleted file mode 100644
index 0f73324d0e0..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive6.tf
+++ /dev/null
@@ -1,19 +0,0 @@
-module "s3_bucket" {
-  source = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.7.0"
-
-  bucket = "my-s3-bucket"
-  acl    = "private"
-
-  versioning = {
-    enabled = true
-  }
-
-   server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        sse_algorithm     = "aws:kms"
-      }
-    }
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive7.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive7.tf
deleted file mode 100644
index e01b4e3a8fa..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive7.tf
+++ /dev/null
@@ -1,17 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-      version = "4.2.0"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-
-resource "aws_s3_bucket" "mybucket0" {
-  bucket = "my-tf-example-bucket"
-}
-
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive8.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive8.tf
deleted file mode 100644
index 60cf993393f..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive8.tf
+++ /dev/null
@@ -1,27 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-      version = "4.2.0"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-
-resource "aws_s3_bucket" "mybucket1" {
-  bucket = "my-tf-example-bucket"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "example2" {
-  bucket = aws_s3_bucket.mybucket1.bucket
-
-  rule {
-    apply_server_side_encryption_by_default  {
-        kms_master_key_id = "some-key"
-        sse_algorithm     = "AES256"
-    }
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive9.tf b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive9.tf
deleted file mode 100644
index c627b08b7b0..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive9.tf
+++ /dev/null
@@ -1,26 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-      version = "4.2.0"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-
-resource "aws_s3_bucket" "mybucket2" {
-  bucket = "my-tf-example-bucket"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "example3" {
-  bucket = aws_s3_bucket.mybucket2.bucket
-
-  rule {
-    apply_server_side_encryption_by_default {
-        sse_algorithm     = "aws:kms"
-    }
-  }
-}
diff --git a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive_expected_result.json b/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive_expected_result.json
deleted file mode 100644
index a2d3215c385..00000000000
--- a/assets/queries/terraform/aws/s3_bucket_sse_disabled/test/positive_expected_result.json
+++ /dev/null
@@ -1,62 +0,0 @@
-[
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 14,
-    "fileName": "positive1.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 26,
-    "fileName": "positive2.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 26,
-    "fileName": "positive3.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 1,
-    "fileName": "positive4.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 15,
-    "fileName": "positive5.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 15,
-    "fileName": "positive6.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 14,
-    "fileName": "positive7.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 23,
-    "fileName": "positive8.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 23,
-    "fileName": "positive9.tf"
-  },
-  {
-    "queryName": "S3 Bucket SSE Disabled",
-    "severity": "HIGH",
-    "line": 21,
-    "fileName": "positive10.tf"
-  }
-]