Project: KICS (Provisioning / Security & Compliance)
File: 4de9de27-254e-424f-bd70-4c1e95790838.md

title: Launch Configuration Is Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4de9de27-254e-424f-bd70-4c1e95790838 Query name: Launch Configuration Is Not Encrypted Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: Launch Configurations should have the data in the volumes encrypted. To encrypt the data, the 'encrypted' parameter should be set to true in each volume<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11 28 36" resource "awslaunchconfiguration" "positive1" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" userdatabase64 = "c29tZUtleQ==" # someKey lifecycle { createbeforedestroy = true } ebsblockdevice { device_name = "/dev/xvda1" } } resource "awslaunchconfiguration" "positive2" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" userdatabase64 = "c29tZUtleQ==" # someKey lifecycle { createbeforedestroy = true } ebsblockdevice { device_name = "/dev/xvda1" encrypted = false } } resource "awslaunchconfiguration" "positive3" { name = "test-launch-config" rootblockdevice { encrypted = false } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="14 23" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true } ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" } ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="24 18" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type =

security_groups = ["sg-12345678"] ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true encrypted = false } ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" } ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="25 14" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true } ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" encrypted = false } ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awslaunchconfiguration" "negative1" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" userdatabase64 = "c29tZUtleQ==" # someKey lifecycle { createbeforedestroy = true } ebsblockdevice { device_name = "/dev/xvda1" encrypted = true } } resource "awslaunchconfiguration" "negative2" { name = "test-launch-config" ephemeralblockdevice { encrypted = false } } ``` ```tf title="Negative test num. 2 - tf file" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true encrypted = true } ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" encrypted = true } ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ```