Repository: bridgecrewio/checkov

Issue:
Add new check: Lambda function should have X-Ray tracing enabled 
tracing_config: https://www.terraform.io/docs/providers/aws/r/lambda_function.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-tracingconfig.html


Add new check: Lambda function should have X-Ray tracing enabled 
tracing_config: https://www.terraform.io/docs/providers/aws/r/lambda_function.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-tracingconfig.html


Add new check: DynamoDB Accelerator (DAX) encryption at rest enabled
https://www.terraform.io/docs/providers/aws/r/dax_cluster.html#server_side_encryption
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dax-cluster.html#cfn-dax-cluster-ssespecification


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py b/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py
@@ -0,0 +1,18 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+class LambdaXrayEnabled(BaseResourceCheck):
+    def __init__(self):
+        name = "X-ray tracing is enabled for Lambda"
+        id = "CKV_AWS_50"
+        supported_resources = ['aws_lambda_function']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        if "tracing_config" in conf.keys():
+            return CheckResult.PASSED
+        return CheckResult.FAILED
+
+
+check = LambdaXrayEnabled()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_LambdaXrayEnabled.py b/tests/terraform/checks/resource/aws/test_LambdaXrayEnabled.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_LambdaXrayEnabled.py
@@ -0,0 +1,90 @@
+import unittest
+
+from checkov.terraform.checks.resource.aws.LambdaXrayEnabled import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestLambdaXrayEnabled(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+              "description": "${var.description}",
+              "environment": [
+                {
+                  "variables": "${var.envvar}"
+                }
+              ],
+              "filename": "${var.filename}",
+              "function_name": "${var.name}",
+              "handler": "${var.handler}",
+              "layers": "${var.layers}",
+              "lifecycle": [
+                {
+                  "ignore_changes": [
+                    "last_modified",
+                    "tags"
+                  ]
+                }
+              ],
+              "memory_size": "${var.memory_size}",
+              "role": "${var.role_arn}",
+              "runtime": "${var.runtime}",
+              "s3_bucket": "${var.s3_bucket}",
+              "s3_key": "${var.s3_key}",
+              "tags": "${var.common_tags}",
+              "timeout": "${var.timeout}",
+              "vpc_config": [
+                {
+                  "security_group_ids": "${var.security_group_ids}",
+                  "subnet_ids": "${var.subnet_ids}"
+                }
+              ]
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+              "description": "${var.description}",
+              "environment": [
+                {
+                  "variables": "${var.envvar}"
+                }
+              ],
+              "filename": "${var.filename}",
+              "function_name": "${var.name}",
+              "handler": "${var.handler}",
+              "layers": "${var.layers}",
+              "lifecycle": [
+                {
+                  "ignore_changes": [
+                    "last_modified",
+                    "tags"
+                  ]
+                }
+              ],
+              "memory_size": "${var.memory_size}",
+              "role": "${var.role_arn}",
+              "runtime": "${var.runtime}",
+              "s3_bucket": "${var.s3_bucket}",
+              "s3_key": "${var.s3_key}",
+              "tags": "${var.common_tags}",
+              "timeout": "${var.timeout}",
+              "tracing_config": [
+                {
+                  "mode": "${var.tracing_mode}"
+                }
+              ],
+              "vpc_config": [
+                {
+                  "security_group_ids": "${var.security_group_ids}",
+                  "subnet_ids": "${var.subnet_ids}"
+                }
+              ]
+            }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()