Add support for KMS Key Policy resources

assets/queries/terraform/aws/kms_key_with_full_permissions/query.rego

@@ -26,10 +26,34 @@ CxPolicy[result] {
 	}
 }
 
+CxPolicy[result] {
+	resource := input.document[i].resource.aws_kms_key_policy[name]
+
+	policy := common_lib.get_policy(resource.policy)
+	st := common_lib.get_statement(policy)
+	statement := st[_]
+
+	common_lib.is_allow_effect(statement)
+	not common_lib.valid_key(statement, "Condition")
+	common_lib.has_wildcard(statement, "kms:*")
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": "aws_kms_key_policy",
+		"resourceName": tf_lib.get_resource_name(resource, name),
+		"searchKey": sprintf("aws_kms_key_policy[%s].policy", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("aws_kms_key_policy[%s].policy should not have wildcard in 'Action' and 'Principal'", [name]),
+		"keyActualValue": sprintf("aws_kms_key_policy[%s].policy has wildcard in 'Action' or 'Principal'", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "aws_kms_key_policy", name, "policy"], []),
+	}
+}
+
 CxPolicy[result] {
 	resource := input.document[i].resource.aws_kms_key[name]
 
 	not common_lib.valid_key(resource, "policy")
+	not has_external_policy(name)
 
 	result := {
 		"documentId": input.document[i].id,
@@ -43,3 +67,8 @@ CxPolicy[result] {
 	}
 }
 
+has_external_policy(name) {
+	keyPolicy := input.document[_].resource.aws_kms_key_policy[_]
+	tf_lib.matches(keyPolicy.key_id, name)
+}
+

assets/queries/terraform/aws/kms_key_with_full_permissions/test/negative2.tf

@@ -0,0 +1,30 @@
+resource "aws_kms_key" "negative2" {
+  description             = "KMS key 2"
+  deletion_window_in_days = 10
+}
+
+resource "aws_kms_key_policy" "negative2" {
+  key_id = aws_kms_key.negative2.id
+  policy = <<POLICY
+    {
+      "Version": "2012-10-17",
+      "Statement":[
+        {
+          "Sid":"AddCannedAcl",
+          "Effect":"Deny",
+          "Principal": {"AWS": [
+            "arn:aws:iam::111122223333:user/CMKUser"
+          ]},
+          "Action": [
+            "kms:Encrypt",
+            "kms:Decrypt",
+            "kms:ReEncrypt*",
+            "kms:GenerateDataKey*",
+            "kms:DescribeKey"
+          ],
+          "Resource":"*"
+        }
+      ]
+    }
+    POLICY
+}

assets/queries/terraform/aws/kms_key_with_full_permissions/test/positive4.tf

@@ -0,0 +1,22 @@
+resource "aws_kms_key" "positive4" {
+  description             = "KMS key 1"
+  deletion_window_in_days = 10
+}
+
+resource "aws_kms_key_policy" "positive4" {
+  key_id = aws_kms_key.positive4.id
+  policy = <<POLICY
+  {
+    "Version": "2012-10-17",
+    "Statement":[
+      {
+        "Sid":"AddCannedAcl",
+        "Effect":"Allow",
+        "Principal": {"AWS":"*"},
+        "Action":["kms:*"],
+        "Resource":"*"
+      }
+    ]
+  }
+  POLICY
+}

assets/queries/terraform/aws/kms_key_with_full_permissions/test/positive5.tf

@@ -0,0 +1,35 @@
+resource "aws_kms_key" "positive50" {
+  description             = "KMS key 5.0"
+  deletion_window_in_days = 10
+}
+
+resource "aws_kms_key" "positive51" {
+  description             = "KMS key 5.1"
+  deletion_window_in_days = 10
+}
+
+resource "aws_kms_key_policy" "positive5" {
+  key_id = aws_kms_key.positive50.id
+  policy = <<POLICY
+  {
+    "Version": "2012-10-17",
+    "Statement":[
+      {
+        "Sid":"AddCannedAcl",
+        "Effect":"Deny",
+        "Principal": {"AWS": [
+          "arn:aws:iam::111122223333:user/CMKUser"
+        ]},
+        "Action": [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ],
+        "Resource":"*"
+      }
+    ]
+  }
+  POLICY
+}

assets/queries/terraform/aws/kms_key_with_full_permissions/test/positive_expected_result.json

@@ -16,5 +16,17 @@
     "severity": "HIGH",
     "line": 1,
     "fileName": "positive3.tf"
+  },
+  {
+    "queryName": "KMS Key With Vulnerable Policy",
+    "severity": "HIGH",
+    "line": 8,
+    "fileName": "positive4.tf"
+  },
+  {
+    "queryName": "KMS Key With Vulnerable Policy",
+    "severity": "HIGH",
+    "line": 6,
+    "fileName": "positive5.tf"
   }
 ]