Repository: bridgecrewio/checkov

Issue:
Add new check: MSK - Ensure Broker logging enabled 
Enable broker logging (to S3, Firehose, or Cloudwatch Logs)

LoggingInfo: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-msk-cluster.html

Terraform does not yet support MSK broker logs: https://github.com/terraform-providers/terraform-provider-aws/issues/12186


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/MSKClusterLogging.py b/checkov/terraform/checks/resource/aws/MSKClusterLogging.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/MSKClusterLogging.py
@@ -0,0 +1,23 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class MSKClusterLogging(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure MSK Cluster logging is enabled"
+        id = "CKV_AWS_80"
+        supported_resources = ['aws_msk_cluster']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        if 'logging_info' in conf.keys() and 'broker_logs' in conf['logging_info'][0]:
+            logging = conf['logging_info'][0]['broker_logs'][0]
+            types = ["cloudwatch_logs", "firehose", "s3"]
+            for x in types:
+                if x in logging and logging[x][0]['enabled'] is True:
+                    return CheckResult.PASSED
+        return CheckResult.FAILED
+
+
+check = MSKClusterLogging()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_MSKClusterLogging.py b/tests/terraform/checks/resource/aws/test_MSKClusterLogging.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_MSKClusterLogging.py
@@ -0,0 +1,126 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.MSKClusterLogging import check
+
+
+class TestMSKClusterLogging(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "name": "test-project",
+            "logging_info": [
+                {
+                    "broker_logs": [
+                        {
+                            "cloudwatch_logs": [
+                                {
+                                    "enabled": False,
+                                }
+                            ],
+                        }
+                    ],
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_failure_none(self):
+        resource_conf = {
+            "name": "test-project",
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "name": "test-project",
+            "logging_info": [
+                {
+                    "broker_logs": [
+                        {
+                            "cloudwatch_logs": [
+                                {
+                                    "enabled": True,
+                                }
+                            ],
+                        }
+                    ],
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_all(self):
+        resource_conf = {
+            "name": "test-project",
+            "logging_info": [
+                {
+                    "broker_logs": [
+                        {
+                            "cloudwatch_logs": [
+                                {
+                                    "enabled": True,
+                                }
+                            ],
+                        },
+                        {
+                            "firehose": [
+                                {
+                                    "enabled": True,
+                                }
+                            ],
+                        },
+                        {
+                            "s3": [
+                                {
+                                    "enabled": True,
+                                }
+                            ],
+                        }
+                    ],
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_mixed(self):
+        resource_conf = {
+            "name": "test-project",
+            "logging_info": [
+                {
+                    "broker_logs": [
+                        {
+                            "cloudwatch_logs": [
+                                {
+                                    "enabled": True,
+                                }
+                            ],
+                        },
+                        {
+                            "firehose": [
+                                {
+                                    "enabled": True,
+                                }
+                            ],
+                        },
+                        {
+                            "s3": [
+                                {
+                                    "enabled": False,
+                                }
+                            ],
+                        }
+                    ],
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()