Repository: bridgecrewio/checkov

Issue:
Add new check: codebuild encryption at rest
Encryption at rest not disabled (encryption_disabled = true and type not NO_ARTIFACTS):
https://www.terraform.io/docs/providers/aws/r/codebuild_project.html


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py b/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py
@@ -0,0 +1,21 @@
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+
+class APIGatewayAuthorization(BaseResourceCheck):
+
+    def __init__(self):
+        name = "Ensure that CodeBuild Project encryption is not disabled"
+        id = "CKV_AWS_78"
+        supported_resources = ['aws_codebuild_project']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf):
+        artifact = conf['artifacts'][0]
+        if artifact['type'] != "NO_ARTIFACTS" and 'encryption_disabled' in artifact and artifact['encryption_disabled']:
+            return CheckResult.FAILED
+        return CheckResult.PASSED
+
+
+check = APIGatewayAuthorization()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_CodeBuildProjectEncryption.py b/tests/terraform/checks/resource/aws/test_CodeBuildProjectEncryption.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_CodeBuildProjectEncryption.py
@@ -0,0 +1,62 @@
+import unittest
+
+from checkov.common.models.enums import CheckResult
+from checkov.terraform.checks.resource.aws.CodeBuildProjectEncryption import check
+
+
+class TestCodeBuildProjectEncryption(unittest.TestCase):
+
+    def test_failure(self):
+        resource_conf = {
+            "name": "test-project",
+            "artifacts": [
+                {
+                    "type": "S3",
+                    "encryption_disabled": True,
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success_type_no_artifacts_encryption_ignored(self):
+        resource_conf = {
+            "name": "test-project",
+            "artifacts": [
+                {
+                    "type": "NO_ARTIFACTS",
+                    "encryption_disabled": True,
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success_no_encryption_disabled(self):
+        resource_conf = {
+            "name": "test-project",
+            "artifacts": [
+                {
+                    "type": "S3",
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_success(self):
+        resource_conf = {
+            "name": "test-project",
+            "artifacts": [
+                {
+                    "type": "S3",
+                    "encryption_disabled": False,
+                }
+            ],
+        }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()