diff --git a/checkov/cloudformation/checks/resource/aws/S3Encryption.py b/checkov/cloudformation/checks/resource/aws/S3Encryption.py index d7285b0219..17cfa3980c 100644 --- a/checkov/cloudformation/checks/resource/aws/S3Encryption.py +++ b/checkov/cloudformation/checks/resource/aws/S3Encryption.py @@ -19,7 +19,7 @@ def get_expected_value(self): return 'AES256' def get_expected_values(self): - return [self.get_expected_value(), 'aws:kms'] + return [self.get_expected_value(), 'aws:kms', 'aws:kms:dsse'] check = S3Encryption() diff --git a/checkov/cloudformation/graph_builder/graph_components/generic_resource_encryption.py b/checkov/cloudformation/graph_builder/graph_components/generic_resource_encryption.py index 33f8387217..afa3c90ded 100644 --- a/checkov/cloudformation/graph_builder/graph_components/generic_resource_encryption.py +++ b/checkov/cloudformation/graph_builder/graph_components/generic_resource_encryption.py @@ -83,6 +83,7 @@ def __init__( { "BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm": [ EncryptionTypes.AWS_KMS_VALUE.value, + EncryptionTypes.AWS_KMS_DSSE_VALUE.value, EncryptionTypes.AES256.value, ], "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.KMSMasterKeyID": get_empty_list_str(), diff --git a/checkov/common/graph/graph_builder/graph_components/attribute_names.py b/checkov/common/graph/graph_builder/graph_components/attribute_names.py index 01d1b0a355..aa01a2ec74 100644 --- a/checkov/common/graph/graph_builder/graph_components/attribute_names.py +++ b/checkov/common/graph/graph_builder/graph_components/attribute_names.py @@ -54,3 +54,4 @@ class EncryptionTypes(str, Enum): DEFAULT_KMS = "Default KMS" AES256 = "AES256" AWS_KMS_VALUE = "aws:kms" + AWS_KMS_DSSE_VALUE = "aws:kms:dsse" diff --git a/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml b/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml index a7c14ea54f..930c4727a4 100644 --- a/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml +++ b/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml @@ -11,6 +11,7 @@ definition: operator: within value: - "aws:kms" + - "aws:kms:dsse" - "AES256" - and: - cond_type: filter @@ -48,4 +49,5 @@ definition: operator: within value: - "aws:kms" + - "aws:kms:dsse" - "AES256" diff --git a/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml b/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml index 6b5d1d7aca..47089c8c43 100644 --- a/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml +++ b/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml @@ -8,8 +8,10 @@ definition: resource_types: - aws_s3_bucket attribute: server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm - operator: equals - value: "aws:kms" + operator: within + value: + - "aws:kms" + - "aws:kms:dsse" - and: - cond_type: filter attribute: resource_type @@ -26,5 +28,7 @@ definition: resource_types: - aws_s3_bucket_server_side_encryption_configuration attribute: rule.apply_server_side_encryption_by_default.sse_algorithm - operator: equals - value: "aws:kms" + operator: within + value: + - "aws:kms" + - "aws:kms:dsse" diff --git a/checkov/terraform/graph_builder/graph_components/generic_resource_encryption.py b/checkov/terraform/graph_builder/graph_components/generic_resource_encryption.py index e64b3dfd17..716ce57b94 100644 --- a/checkov/terraform/graph_builder/graph_components/generic_resource_encryption.py +++ b/checkov/terraform/graph_builder/graph_components/generic_resource_encryption.py @@ -111,6 +111,7 @@ def __init__( { "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm": [ EncryptionTypes.AWS_KMS_VALUE.value, + EncryptionTypes.AWS_KMS_DSSE_VALUE.value, EncryptionTypes.AES256.value, ], "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id": get_empty_list_str(), diff --git a/tests/cloudformation/checks/resource/aws/example_S3EncryptionDsse/DsseKms.yaml b/tests/cloudformation/checks/resource/aws/example_S3EncryptionDsse/DsseKms.yaml new file mode 100644 index 0000000000..9da8fc9924 --- /dev/null +++ b/tests/cloudformation/checks/resource/aws/example_S3EncryptionDsse/DsseKms.yaml @@ -0,0 +1,32 @@ +AWSTemplateFormatVersion: 2010-09-09 +Resources: + PassDsseKms: + Type: AWS::S3::Bucket + Properties: + BucketEncryption: + ServerSideEncryptionConfiguration: + - ServerSideEncryptionByDefault: + KMSMasterKeyID: String + SSEAlgorithm: aws:kms:dsse + PassKms: + Type: AWS::S3::Bucket + Properties: + BucketEncryption: + ServerSideEncryptionConfiguration: + - ServerSideEncryptionByDefault: + KMSMasterKeyID: String + SSEAlgorithm: aws:kms + PassAes256: + Type: AWS::S3::Bucket + Properties: + BucketEncryption: + ServerSideEncryptionConfiguration: + - ServerSideEncryptionByDefault: + SSEAlgorithm: AES256 + FailUnknownAlgorithm: + Type: AWS::S3::Bucket + Properties: + BucketEncryption: + ServerSideEncryptionConfiguration: + - ServerSideEncryptionByDefault: + SSEAlgorithm: aws:kms:dss diff --git a/tests/cloudformation/checks/resource/aws/test_S3Encryption.py b/tests/cloudformation/checks/resource/aws/test_S3Encryption.py index bd3ff90c15..da79fe14f4 100644 --- a/tests/cloudformation/checks/resource/aws/test_S3Encryption.py +++ b/tests/cloudformation/checks/resource/aws/test_S3Encryption.py @@ -21,6 +21,30 @@ def test_summary(self): self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) + def test_dsse_kms(self): + runner = Runner() + current_dir = os.path.dirname(os.path.realpath(__file__)) + + test_files_dir = current_dir + "/example_S3EncryptionDsse" + report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) + summary = report.get_summary() + + passing_resources = { + "AWS::S3::Bucket.PassDsseKms", + "AWS::S3::Bucket.PassKms", + "AWS::S3::Bucket.PassAes256", + } + failing_resources = { + "AWS::S3::Bucket.FailUnknownAlgorithm", + } + + self.assertEqual(summary['passed'], 3) + self.assertEqual(summary['failed'], 1) + self.assertEqual(summary['skipped'], 0) + self.assertEqual(summary['parsing_errors'], 0) + self.assertEqual(passing_resources, {c.resource for c in report.passed_checks}) + self.assertEqual(failing_resources, {c.resource for c in report.failed_checks}) + if __name__ == '__main__': unittest.main() diff --git a/tests/terraform/graph/checks/resources/S3BucketEncryption/expected.yaml b/tests/terraform/graph/checks/resources/S3BucketEncryption/expected.yaml index 73b2b99d42..c1c767c9a8 100644 --- a/tests/terraform/graph/checks/resources/S3BucketEncryption/expected.yaml +++ b/tests/terraform/graph/checks/resources/S3BucketEncryption/expected.yaml @@ -5,9 +5,11 @@ pass: - "aws_s3_bucket.bucket_good_5" - "aws_s3_bucket.bucket_good_6" - "aws_s3_bucket.default_encryption_bucket" + - "aws_s3_bucket.bucket_good_dsse_inline" + - "aws_s3_bucket.bucket_good_dsse_sse" fail: - "aws_s3_bucket.bucket_bad_2" - "aws_s3_bucket.bucket_bad_3" - "aws_s3_bucket.bucket_bad_4" - "aws_s3_bucket.bucket_bad_5" - - "aws_s3_bucket.bucket_bad_6" \ No newline at end of file + - "aws_s3_bucket.bucket_bad_6" diff --git a/tests/terraform/graph/checks/resources/S3BucketEncryption/main.tf b/tests/terraform/graph/checks/resources/S3BucketEncryption/main.tf index 06f7568b71..285c9f1a9a 100644 --- a/tests/terraform/graph/checks/resources/S3BucketEncryption/main.tf +++ b/tests/terraform/graph/checks/resources/S3BucketEncryption/main.tf @@ -192,4 +192,32 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "bad_sse_3" { } } } -} \ No newline at end of file +} + +resource "aws_s3_bucket" "bucket_good_dsse_inline" { + bucket = "bucket_good_dsse_inline" + + server_side_encryption_configuration { + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = aws_kms_key.mykey.arn + sse_algorithm = "aws:kms:dsse" + } + } + } +} + +resource "aws_s3_bucket" "bucket_good_dsse_sse" { + bucket = "bucket_good_dsse_sse" +} + +resource "aws_s3_bucket_server_side_encryption_configuration" "good_sse_dsse" { + bucket = aws_s3_bucket.bucket_good_dsse_sse.bucket + + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = aws_kms_key.mykey.arn + sse_algorithm = "aws:kms:dsse" + } + } +} diff --git a/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/expected.yaml b/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/expected.yaml index 7b1d723edb..73987964ab 100644 --- a/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/expected.yaml +++ b/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/expected.yaml @@ -2,10 +2,12 @@ pass: - "aws_s3_bucket.bucket_good_1" - "aws_s3_bucket.bucket_good_3" - "aws_s3_bucket.bucket_good_6" + - "aws_s3_bucket.bucket_good_dsse_inline" + - "aws_s3_bucket.bucket_good_dsse_sse" fail: - "aws_s3_bucket.bucket_bad_1" - "aws_s3_bucket.bucket_bad_2" - "aws_s3_bucket.bucket_bad_3" - "aws_s3_bucket.bucket_bad_4" - "aws_s3_bucket.bucket_bad_5" - - "aws_s3_bucket.bucket_bad_6" \ No newline at end of file + - "aws_s3_bucket.bucket_bad_6" diff --git a/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/main.tf b/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/main.tf index 7096912a32..445d01cfe0 100644 --- a/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/main.tf +++ b/tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/main.tf @@ -162,4 +162,32 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "bad_sse_3" { } } } -} \ No newline at end of file +} + +resource "aws_s3_bucket" "bucket_good_dsse_inline" { + bucket = "bucket_good_dsse_inline" + + server_side_encryption_configuration { + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = aws_kms_key.mykey.arn + sse_algorithm = "aws:kms:dsse" + } + } + } +} + +resource "aws_s3_bucket" "bucket_good_dsse_sse" { + bucket = "bucket_good_dsse_sse" +} + +resource "aws_s3_bucket_server_side_encryption_configuration" "good_sse_dsse" { + bucket = aws_s3_bucket.bucket_good_dsse_sse.bucket + + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = aws_kms_key.mykey.arn + sse_algorithm = "aws:kms:dsse" + } + } +}