Repository: bridgecrewio/checkov

Issue:
Add new check: DynamoDB Accelerator (DAX) encryption at rest enabled
https://www.terraform.io/docs/providers/aws/r/dax_cluster.html#server_side_encryption
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dax-cluster.html#cfn-dax-cluster-ssespecification


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/DAXEncryption.py b/checkov/terraform/checks/resource/aws/DAXEncryption.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/DAXEncryption.py
@@ -0,0 +1,16 @@
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+from checkov.common.models.enums import CheckCategories
+
+
+class DAXEncryption(BaseResourceValueCheck):
+    def __init__(self):
+        name = "Ensure DAX is encrypted at rest (default is unencrypted)"
+        id = "CKV_AWS_47"
+        supported_resources = ['aws_dax_cluster']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "server_side_encryption/[0]/enabled"
+
+check = DAXEncryption()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_DAXEncryption.py b/tests/terraform/checks/resource/aws/test_DAXEncryption.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_DAXEncryption.py
@@ -0,0 +1,39 @@
+import unittest
+
+from checkov.terraform.checks.resource.aws.DAXEncryption import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestDAXEncryption(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf =  {
+		      "cluster_name": "${var.cluster_name}",
+              "iam_role_arn": "${var.iam_role_arn}",
+              "parameter_group_name": "${aws_dax_parameter_group.example.name}",
+              "subnet_group_name": "${aws_dax_subnet_group.example.name}",
+              "tags": "${var.common_tags}"
+            }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf =  {
+              "cluster_name": "${var.cluster_name}",
+              "iam_role_arn": "${var.iam_role_arn}",
+              "parameter_group_name": "${aws_dax_parameter_group.example.name}",
+              "server_side_encryption": [
+                {
+                  "enabled": [True]
+                }
+              ],
+              "subnet_group_name": "${aws_dax_subnet_group.example.name}",
+              "tags": "${var.common_tags}"
+            }
+
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/terraform/checks/resource/aws/test_DynamodbRecovery.py b/tests/terraform/checks/resource/aws/test_DynamodbRecovery.py
--- a/tests/terraform/checks/resource/aws/test_DynamodbRecovery.py
+++ b/tests/terraform/checks/resource/aws/test_DynamodbRecovery.py
@@ -4,7 +4,7 @@
 from checkov.common.models.enums import CheckResult
 
 
-class TestEBSEncryption(unittest.TestCase):
+class TestDynamodbRecovery(unittest.TestCase):
 
     def test_failure(self):
         resource_conf = {'name': ['violations_for_resources${var.unique_tag}'], 'billing_mode': ['PAY_PER_REQUEST'],