Repository: bridgecrewio/checkov

Issue:
Add new check: DMS Replication Instance should not be publicly accessible
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dms-replicationinstance.html
https://www.terraform.io/docs/providers/aws/r/dms_replication_instance.html



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py b/checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py
@@ -0,0 +1,21 @@
+from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck
+
+
+class DMSReplicationInstancePubliclyAccessible(BaseResourceNegativeValueCheck):
+    def __init__(self):
+        name = "DMS replication instance should not be publicly accessible"
+        id = "CKV_AWS_89"
+        supported_resources = ['aws_dms_replication_instance']
+        categories = [CheckCategories.NETWORKING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return 'publicly_accessible'
+
+    def get_forbidden_values(self):
+        return [True]
+
+
+check = DMSReplicationInstancePubliclyAccessible()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_DMSReplicationInstancePubliclyAccessible.py b/tests/terraform/checks/resource/aws/test_DMSReplicationInstancePubliclyAccessible.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_DMSReplicationInstancePubliclyAccessible.py
@@ -0,0 +1,40 @@
+import unittest
+import hcl2
+
+from checkov.terraform.checks.resource.aws.DMSReplicationInstancePubliclyAccessible import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestDMSReplicationInstancePubliclyAccessible(unittest.TestCase):
+
+    def test_failure(self):
+        hcl_res = hcl2.loads("""
+          resource "aws_dms_replication_instance" "public" {
+            engine_version               = "3.1.4"
+            multi_az                     = false
+            publicly_accessible          = true
+            replication_instance_class   = "dms.t2.micro"
+            replication_instance_id      = "test-dms-replication-instance-tf"
+          }
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_dms_replication_instance']['public']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        hcl_res = hcl2.loads("""
+          resource "aws_dms_replication_instance" "private" {
+            engine_version               = "3.1.4"
+            multi_az                     = false
+            publicly_accessible          = false
+            replication_instance_class   = "dms.t2.micro"
+            replication_instance_id      = "test-dms-replication-instance-tf"
+          }
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_dms_replication_instance']['private']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()