Repository: liamg/tfsec
Pull request #102 (2020-04-05 10:47:47)

adding kinesis stream check #33
adding kinesis stream check #33


Patch:
diff --git a/internal/app/tfsec/checks/aws_unencrypted_kinesis_streams.go b/internal/app/tfsec/checks/aws_unencrypted_kinesis_streams.go
new file mode 100644
index 000000000..7b0fc2012
--- /dev/null
+++ b/internal/app/tfsec/checks/aws_unencrypted_kinesis_streams.go
@@ -0,0 +1,46 @@
+package checks
+
+import (
+	"fmt"
+
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/liamg/tfsec/internal/app/tfsec/scanner"
+
+	"github.com/liamg/tfsec/internal/app/tfsec/parser"
+)
+
+// AWSUnencryptedKinesisStream See https://github.com/liamg/tfsec#included-checks for check info
+const AWSUnencryptedKinesisStream scanner.RuleID = "AWS024"
+
+func init() {
+	scanner.RegisterCheck(scanner.Check{
+		Code:           AWSUnencryptedKinesisStream,
+		RequiredTypes:  []string{"resource"},
+		RequiredLabels: []string{"aws_kinesis_stream"},
+		CheckFunc: func(check *scanner.Check, block *parser.Block, context *scanner.Context) []scanner.Result {
+
+			encryptionTypeAttr := block.GetAttribute("encryption_type")
+			if encryptionTypeAttr == nil {
+				return []scanner.Result{
+					check.NewResult(
+						fmt.Sprintf("Resource '%s' defines an unencrypted Kinesis Stream.", block.Name()),
+						block.Range(),
+						scanner.SeverityError,
+					),
+				}
+			} else if encryptionTypeAttr.Type() == cty.String && encryptionTypeAttr.Value().AsString() == "" || encryptionTypeAttr.Value().AsString() == "NONE" || encryptionTypeAttr.Value().AsString() == "None" {
+				return []scanner.Result{
+					check.NewResultWithValueAnnotation(
+						fmt.Sprintf("Resource '%s' defines an unencrypted Kinesis Stream.", block.Name()),
+						encryptionTypeAttr.Range(),
+						encryptionTypeAttr,
+						scanner.SeverityError,
+					),
+				}
+			}
+
+			return nil
+		},
+	})
+}
\ No newline at end of file


Test patch:
diff --git a/internal/app/tfsec/aws_unencrypted_kinesis_streams_test.go b/internal/app/tfsec/aws_unencrypted_kinesis_streams_test.go
new file mode 100644
index 000000000..8f38ad8a7
--- /dev/null
+++ b/internal/app/tfsec/aws_unencrypted_kinesis_streams_test.go
@@ -0,0 +1,52 @@
+package tfsec
+
+import (
+	"testing"
+
+	"github.com/liamg/tfsec/internal/app/tfsec/scanner"
+
+	"github.com/liamg/tfsec/internal/app/tfsec/checks"
+)
+
+func Test_AWSUnencryptedKinesisStream(t *testing.T) {
+
+	var tests = []struct {
+		name                  string
+		source                string
+		mustIncludeResultCode scanner.RuleID
+		mustExcludeResultCode scanner.RuleID
+	}{
+		{
+			name: "check no encryption key id specified for aws_sqs_queue",
+			source: `
+resource "aws_kinesis_stream" "test_stream" {
+	
+}`,
+			mustIncludeResultCode: checks.AWSUnencryptedKinesisStream,
+		},
+		{
+			name: "check blank encryption key id specified for aws_sqs_queue",
+			source: `
+resource "aws_kinesis_stream" "test_stream" {
+	encryption_type = "NONE"
+}`,
+			mustIncludeResultCode: checks.AWSUnencryptedKinesisStream,
+		},
+		{
+			name: "check encryption key id specified for aws_sqs_queue",
+			source: `
+resource "aws_kinesis_stream" "test_stream" {
+	encryption_type = "KMS"
+}`,
+			mustExcludeResultCode: checks.AWSUnencryptedKinesisStream,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			results := scanSource(test.source)
+			assertCheckCode(t, test.mustIncludeResultCode, test.mustExcludeResultCode, results)
+		})
+	}
+
+}
\ No newline at end of file