Repository: bridgecrewio/checkov

Issue:
Add new check: DynamoDB Accelerator (DAX) encryption at rest enabled
https://www.terraform.io/docs/providers/aws/r/dax_cluster.html#server_side_encryption
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dax-cluster.html#cfn-dax-cluster-ssespecification


Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/aws/MQBrokerLogging.py b/checkov/terraform/checks/resource/aws/MQBrokerLogging.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/resource/aws/MQBrokerLogging.py
@@ -0,0 +1,16 @@
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+from checkov.common.models.enums import CheckCategories
+
+
+class MQBrokerLogging(BaseResourceValueCheck):
+    def __init__(self):
+        name = "Ensure MQ Broker logging is enabled"
+        id = "CKV_AWS_48"
+        supported_resources = ['aws_mq_broker']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "logs/[0]/general"
+
+check = MQBrokerLogging()


Test patch:
diff --git a/tests/terraform/checks/resource/aws/test_MQBrokerLogging.py b/tests/terraform/checks/resource/aws/test_MQBrokerLogging.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/resource/aws/test_MQBrokerLogging.py
@@ -0,0 +1,67 @@
+import unittest
+
+from checkov.terraform.checks.resource.aws.MQBrokerLogging import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestMQBrokerLogging(unittest.TestCase):
+
+    def test_failure_mqbroker_logging(self):
+        resource_conf = {
+              "broker_name": "example",
+              "configuration": [
+                {
+                  "id": "${aws_mq_configuration.test.id}",
+                  "revision": "${aws_mq_configuration.test.latest_revision}"
+                }
+              ],
+              "engine_type": "ActiveMQ",
+              "engine_version": "5.15.0",
+              "host_instance_type": "mq.t2.micro",
+              "security_groups": [
+                "${aws_security_group.test.id}"
+              ],
+              "user": [
+                {
+                  "password": "MindTheGap",
+                  "username": "ExampleUser"
+                }
+              ]
+            }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success_mqbroker_logging(self):
+
+        resource_conf = {
+              "broker_name": "example",
+              "configuration": [
+                {
+                  "id": "${aws_mq_configuration.test.id}",
+                  "revision": "${aws_mq_configuration.test.latest_revision}"
+                }
+              ],
+              "engine_type": "ActiveMQ",
+              "engine_version": "5.15.0",
+              "host_instance_type": "mq.t2.micro",
+              "security_groups": [
+                "${aws_security_group.test.id}"
+              ],
+              "user": [
+                {
+                  "password": "MindTheGap",
+                  "username": "ExampleUser"
+                }
+              ],
+              "logs" : [
+                { 
+                  "general": [True] 
+                }
+              ]
+            }
+        scan_result = check.scan_resource_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()