Repository: bridgecrewio/checkov

Issue:
Add new check: Glue Data Catalog Encryption at rest and connection parameter encryption
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-glue-datacatalogencryptionsettings-datacatalogencryptionsettings.html

Note this is currently not covered in Terraform: https://github.com/terraform-providers/terraform-provider-aws/issues/9736



Discussion:
when https://github.com/terraform-providers/terraform-provider-aws/pull/14916 is merged ill add the check 😉 
@DrFaust92 https://github.com/terraform-providers/terraform-provider-aws/pull/14916 was merged a few days ago. 😃 

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py b/checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py
@@ -0,0 +1,35 @@
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck
+
+
+class GlueDataCatalogEncryption(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure Glue Data Catalog Encryption is enabled"
+        id = "CKV_AWS_94"
+        supported_resources = ['aws_glue_data_catalog_encryption_settings']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        if 'data_catalog_encryption_settings' in conf:
+            data_conf = conf['data_catalog_encryption_settings'][0]
+            connection_encrypted = False
+            encrypted_at_rest = False
+            if 'encryption_at_rest' in data_conf:
+                enc_res = data_conf['encryption_at_rest'][0]
+                if 'catalog_encryption_mode' in enc_res and 'sse_aws_kms_key_id' in enc_res:
+                    if enc_res['catalog_encryption_mode'][0] == "SSE-KMS":
+                        encrypted_at_rest = True
+
+            if 'connection_password_encryption' in data_conf:
+                con_res = data_conf['connection_password_encryption'][0]
+                if 'return_connection_password_encrypted' in con_res and 'aws_kms_key_id' in con_res:
+                    if con_res['return_connection_password_encrypted'][0] == True:
+                        connection_encrypted = True
+
+            if encrypted_at_rest and connection_encrypted:
+                return CheckResult.PASSED
+        return CheckResult.FAILED
+
+
+check = GlueDataCatalogEncryption()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_GlueDataCatalogEncryption.py b/tests/terraform/checks/resource/aws/test_GlueDataCatalogEncryption.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_GlueDataCatalogEncryption.py
@@ -0,0 +1,46 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.GlueDataCatalogEncryption import check
+import hcl2
+
+class TestGlueDataCatalogEncryption(unittest.TestCase):
+
+    def test_failure(self):
+        hcl_res = hcl2.loads("""
+resource "aws_glue_data_catalog_encryption_settings" "test" {
+  data_catalog_encryption_settings {
+    connection_password_encryption {
+      return_connection_password_encrypted = false
+    }
+    encryption_at_rest {
+      catalog_encryption_mode = "DISABLED"
+    }
+  }
+}
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_glue_data_catalog_encryption_settings']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        hcl_res = hcl2.loads("""
+resource "aws_glue_data_catalog_encryption_settings" "test" {
+  data_catalog_encryption_settings {
+    connection_password_encryption {
+      aws_kms_key_id                       = aws_kms_key.test.arn
+      return_connection_password_encrypted = true
+    }
+    encryption_at_rest {
+      catalog_encryption_mode = "SSE-KMS"
+      sse_aws_kms_key_id      = aws_kms_key.test.arn
+    }
+  }
+}
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_glue_data_catalog_encryption_settings']['test']
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+if __name__ == '__main__':
+    unittest.main()