Repository: bridgecrewio/checkov

Issue:
CKV_AWS_299 Fails for Values That Can't be Set
**Describe the issue**
Failing on - Check: CKV_AWS_299: "Ensure DMS S3 defines in-transit encryption"

When the endpoint of a DMS Migration Task has a Endpoint that is S3, there is no option in AWS to specify ssl_mode. AWS does not have an ssl_mode for DMS Endpoints of type S3. Setting this value on extra connections does nothing. Also, setting this in Terraform does nothing. I may be crazy, but I think DMS transfers to S3 uses SSL by default.

**Examples**
```

from __future__ import annotations

from typing import Any

from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
from checkov.common.models.enums import CheckCategories


class DMSS3DefinesIntransitEncryption(BaseResourceValueCheck):
    def __init__(self) -> None:
        name = "Ensure DMS S3 defines in-transit encryption"
        id = "CKV_AWS_299"
        supported_resources = ("aws_dms_s3_endpoint",)
        categories = (CheckCategories.ENCRYPTION,)
        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)

    def get_inspected_key(self) -> str:
        return 'ssl_mode'

    def get_expected_values(self) -> list[Any]:
        return ["require", "verify-ca", "verify-full"]


check = DMSS3DefinesIntransitEncryption()

```

**Version (please complete the following information):**
 - Checkov Version 2.3.343

**Additional context**

This is property does nothing in terraform when the aws_dme_enpoint is s3 and I file and issue over there, however, it was closed with no fix.


Discussion:
hey @rossbush thanks for reaching out.

I think you are right. I also checked and my guess is, it is a copy paste error by Terraform. the normal DMS endpoint offers this functionality, but not S3.

hey @JamesWoolfenden can you remember something, when you added it?
> hey @rossbush thanks for reaching out.
> 
> I think you are right. I also checked and my guess is, it is a copy paste error by Terraform. the normal DMS endpoint offers this functionality, but not S3.
> 
> hey @JamesWoolfenden can you remember something, when you added it?

Greetings @gruebel, this a Quazi catch-22.  When the ssl_mode value is set to anything other than "none", then AWS returns an InvalidParamaterCombination, when the endpoint is of type S3.

[See bug logged with terraform](https://github.com/hashicorp/terraform-provider-aws/issues/31821). On one hand, to pass Checkov, the value is set it to anything other than "none" but then an AWS exception is encountered during apply.

To get around the AWS exception, we set the value to "none" but then the Checov rule fails.

Currently, corporate has made this a soft fail for our pipelines, however, we are getting a heap of warnings and to me it just seems like an obsolete rule. There is no value allowed other than "none" for the resource backed by `DMSS3DefinesIntransitEncryption`


Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/DMSS3DefinesIntransitEncryption.py b/checkov/terraform/checks/resource/aws/DMSS3DefinesIntransitEncryption.py
deleted file mode 100644
--- a/checkov/terraform/checks/resource/aws/DMSS3DefinesIntransitEncryption.py
+++ /dev/null
@@ -1,24 +0,0 @@
-from __future__ import annotations
-
-from typing import Any
-
-from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
-from checkov.common.models.enums import CheckCategories
-
-
-class DMSS3DefinesIntransitEncryption(BaseResourceValueCheck):
-    def __init__(self) -> None:
-        name = "Ensure DMS S3 defines in-transit encryption"
-        id = "CKV_AWS_299"
-        supported_resources = ("aws_dms_s3_endpoint",)
-        categories = (CheckCategories.ENCRYPTION,)
-        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
-
-    def get_inspected_key(self) -> str:
-        return 'ssl_mode'
-
-    def get_expected_values(self) -> list[Any]:
-        return ["require", "verify-ca", "verify-full"]
-
-
-check = DMSS3DefinesIntransitEncryption()


Test patch:
diff --git a/performance_tests/test_checkov_performance.py b/performance_tests/test_checkov_performance.py
--- a/performance_tests/test_checkov_performance.py
+++ b/performance_tests/test_checkov_performance.py
@@ -18,7 +18,7 @@
         'repo_name': 'terraform-aws-components',
         'threshold': {
             "Darwin": 19.0,
-            "Linux": 13.0,
+            "Linux": 8.0,
             "Windows": 15.0,
         }
     },
@@ -26,7 +26,7 @@
         'repo_name': 'aws-cloudformation-templates',
         'threshold': {
             "Darwin": 350.0,
-            "Linux": 240.0,
+            "Linux": 170.0,
             "Windows": 300.0,
         }
     },
@@ -34,7 +34,7 @@
         'repo_name': 'kubernetes-yaml-templates',
         'threshold': {
             "Darwin": 550.0,
-            "Linux": 280.0,
+            "Linux": 180.0,
             "Windows": 500.0,
         }
     }
diff --git a/tests/kustomize/test_runner_image_referencer.py b/tests/kustomize/test_runner_image_referencer.py
--- a/tests/kustomize/test_runner_image_referencer.py
+++ b/tests/kustomize/test_runner_image_referencer.py
@@ -21,7 +21,7 @@
 RESOURCES_PATH = Path(__file__).parent / "runner/resources"
 
 
-@pytest.mark.xfail(sys.version_info.minor == 9, reason="for some reason this test is flaky on Python 3.9")
+@pytest.mark.xfail(reason="This is probably connected to the OS + kustomize version")
 @pytest.mark.skipif(os.name == "nt" or not kustomize_exists(), reason="kustomize not installed or Windows OS")
 @pytest.mark.parametrize("allow_kustomize_file_edits, code_lines", [
     (True, "18-34"),
diff --git a/tests/terraform/checks/resource/aws/example_DMSS3DefinesIntransitEncryption/main.tf b/tests/terraform/checks/resource/aws/example_DMSS3DefinesIntransitEncryption/main.tf
deleted file mode 100644
--- a/tests/terraform/checks/resource/aws/example_DMSS3DefinesIntransitEncryption/main.tf
+++ /dev/null
@@ -1,28 +0,0 @@
-resource "aws_dms_s3_endpoint" "fail" {
-  endpoint_id             = "donnedtipi"
-  endpoint_type           = "target"
-  bucket_name             = "beckut_name"
-  service_access_role_arn = aws_iam_role.example.arn
-  depends_on = [aws_iam_role_policy.example]
-}
-
-resource "aws_dms_s3_endpoint" "fail2" {
-  endpoint_id             = "donnedtipi"
-  endpoint_type           = "target"
-  bucket_name             = "beckut_name"
-  service_access_role_arn = aws_iam_role.example.arn
-  ssl_mode="none"
-  kms_key_arn=""
-  depends_on = [aws_iam_role_policy.example]
-}
-
-resource "aws_dms_s3_endpoint" "pass" {
-  endpoint_id             = "donnedtipi"
-  endpoint_type           = "target"
-  bucket_name             = "beckut_name"
-  service_access_role_arn = aws_iam_role.example.arn
-  ssl_mode="require"
-  kms_key_arn="arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
-  depends_on = [aws_iam_role_policy.example]
-}
-
diff --git a/tests/terraform/checks/resource/aws/test_DMSS3DefinesIntransitEncryption.py b/tests/terraform/checks/resource/aws/test_DMSS3DefinesIntransitEncryption.py
deleted file mode 100644
--- a/tests/terraform/checks/resource/aws/test_DMSS3DefinesIntransitEncryption.py
+++ /dev/null
@@ -1,39 +0,0 @@
-import os
-import unittest
-
-from checkov.runner_filter import RunnerFilter
-from checkov.terraform.checks.resource.aws.DMSS3DefinesIntransitEncryption import check
-from checkov.terraform.runner import Runner
-
-
-class TestDMSS3DefinesIntransitEncryption(unittest.TestCase):
-    def test(self):
-        runner = Runner()
-        current_dir = os.path.dirname(os.path.realpath(__file__))
-
-        test_files_dir = current_dir + "/example_DMSS3DefinesIntransitEncryption"
-        report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]))
-        summary = report.get_summary()
-
-        passing_resources = {
-            "aws_dms_s3_endpoint.pass",
-        }
-        failing_resources = {
-            "aws_dms_s3_endpoint.fail",
-            "aws_dms_s3_endpoint.fail2",
-        }
-
-        passed_check_resources = set([c.resource for c in report.passed_checks])
-        failed_check_resources = set([c.resource for c in report.failed_checks])
-
-        self.assertEqual(summary["passed"], len(passing_resources))
-        self.assertEqual(summary["failed"], len(failing_resources))
-        self.assertEqual(summary["skipped"], 0)
-        self.assertEqual(summary["parsing_errors"], 0)
-
-        self.assertEqual(passing_resources, passed_check_resources)
-        self.assertEqual(failing_resources, failed_check_resources)
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/tests/terraform/runner/test_runner.py b/tests/terraform/runner/test_runner.py
--- a/tests/terraform/runner/test_runner.py
+++ b/tests/terraform/runner/test_runner.py
@@ -325,7 +325,7 @@ def test_no_missing_ids(self):
             reverse=True,
             key=lambda s: int(s.split('_')[-1])
         )
-        for i in range(1, len(aws_checks) + 7):
+        for i in range(1, len(aws_checks) + 8):
             if f'CKV_AWS_{i}' == 'CKV_AWS_4':
                 # CKV_AWS_4 was deleted due to https://github.com/bridgecrewio/checkov/issues/371
                 continue
@@ -338,6 +338,10 @@ def test_no_missing_ids(self):
             if f'CKV_AWS_{i}' == 'CKV_AWS_52':
                 # CKV_AWS_52 was deleted since it cannot be toggled in terraform.
                 continue
+            if f'CKV_AWS_{i}' == 'CKV_AWS_299':
+                # CKV_AWS_299 was deleted because AWS doesn't support it and seems to be a bug in Terraform.
+                # https://github.com/hashicorp/terraform-provider-aws/issues/31821
+                continue
             self.assertIn(f'CKV_AWS_{i}', aws_checks, msg=f'The new AWS violation should have the ID "CKV_AWS_{i}"')
 
         gcp_checks = sorted(