Repository: bridgecrewio/checkov

Issue:
Add new check: ECS ensure container insights is enabled 
https://www.terraform.io/docs/providers/aws/r/ecs_cluster.html
ClusterSettings: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-cluster.html#cfn-ecs-cluster-clustersettings

	https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-cluster-clustersetting.html


Discussion:

Resolving patch:
diff --git a/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py b/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py
new file mode 100644
--- /dev/null
+++ b/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py
@@ -0,0 +1,27 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class ECSClusterContainerInsights(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure container insights are enabled on ECS cluster"
+        id = "CKV_AWS_65"
+        supported_resources = ['AWS::ECS::Cluster']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        """
+            Looks for container insights configuration on ECS cluster:
+            https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-cluster.html#cfn-ecs-cluster-clustersettings
+        :param conf: AWS::ECS::Cluster configuration
+        :return: <CheckResult>
+        """
+        if 'Properties' in conf.keys():
+            if 'ClusterSettings' in conf['Properties'].keys():
+                for setting in conf['Properties']['ClusterSettings']:
+                    if setting['Name'] == 'containerInsights' and setting['Value'] == 'enabled':
+                        return CheckResult.PASSED
+        return CheckResult.FAILED
+
+check = ECSClusterContainerInsights()
diff --git a/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py b/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py
@@ -0,0 +1,24 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck
+
+
+class ECSClusterContainerInsights(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure container insights are enabled on ECS cluster"
+        id = "CKV_AWS_65"
+        supported_resources = ['aws_ecs_cluster']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        print(conf)
+        if 'setting' in conf.keys():
+            setting_conf = conf['setting']
+            for setting in setting_conf:
+                print(setting)
+                if setting['name'] == ['containerInsights'] and setting['value'] == ['enabled']:
+                    return CheckResult.PASSED
+        return CheckResult.FAILED
+
+
+check = ECSClusterContainerInsights()


Test patch:
diff --git a/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED-2.yaml b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED-2.yaml
new file mode 100644
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED-2.yaml
@@ -0,0 +1,8 @@
+Resources:
+  ECSCluster:
+    Type: 'AWS::ECS::Cluster'
+    Properties:
+      ClusterName: 'MyCluster'
+      ClusterSettings:
+        - Name: 'containerInsights'
+          Value: 'disabled'
diff --git a/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED.yaml b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED.yaml
new file mode 100644
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED.yaml
@@ -0,0 +1,5 @@
+Resources:
+  ECSCluster:
+    Type: 'AWS::ECS::Cluster'
+    Properties:
+      ClusterName: 'MyCluster'
diff --git a/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED.yaml b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED.yaml
new file mode 100644
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED.yaml
@@ -0,0 +1,8 @@
+Resources:
+  ECSCluster:
+    Type: 'AWS::ECS::Cluster'
+    Properties:
+      ClusterName: 'MyCluster'
+      ClusterSettings:
+        - Name: 'containerInsights'
+          Value: 'enabled'
diff --git a/tests/cloudformation/checks/resource/aws/test_ECSClusterContainerInsights.py b/tests/cloudformation/checks/resource/aws/test_ECSClusterContainerInsights.py
new file mode 100644
--- /dev/null
+++ b/tests/cloudformation/checks/resource/aws/test_ECSClusterContainerInsights.py
@@ -0,0 +1,26 @@
+import os
+import unittest
+
+from checkov.cloudformation.checks.resource.aws.ECSClusterContainerInsights import check
+from checkov.cloudformation.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestECSClusterContainerInsights(unittest.TestCase):
+
+    def test_summary(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = current_dir + "/example_ECSClusterContainerInsights"
+        report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        self.assertEqual(summary['passed'], 1)
+        self.assertEqual(summary['failed'], 2)
+        self.assertEqual(summary['skipped'], 0)
+        self.assertEqual(summary['parsing_errors'], 0)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/terraform/checks/resource/aws/test_ECSClusterContainerInsights.py b/tests/terraform/checks/resource/aws/test_ECSClusterContainerInsights.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_ECSClusterContainerInsights.py
@@ -0,0 +1,41 @@
+import unittest
+
+import hcl2
+
+from checkov.terraform.checks.resource.aws.ECSClusterContainerInsights import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestECSClusterContainerInsights(unittest.TestCase):
+
+    def test_failure(self):
+        hcl_res = hcl2.loads(
+            """
+            resource "aws_ecs_cluster" "my_cluster" {
+                name = "white-hart"
+            }
+            """
+        )
+        resource_conf = hcl_res['resource'][0]['aws_ecs_cluster']['my_cluster']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        hcl_res = hcl2.loads(
+            """
+            resource "aws_ecs_cluster" "my_cluster" {
+                name = "white-hart"
+                setting {
+                    name = "containerInsights"
+                    value = "enabled"
+                }
+            }
+            """
+        )
+        resource_conf = hcl_res['resource'][0]['aws_ecs_cluster']['my_cluster']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == "__main__":
+    unittest.main()