fix(aws): accept aws:kms:dsse as valid S3 server-side encryption

checkov/cloudformation/checks/resource/aws/S3Encryption.py

@@ -19,7 +19,7 @@ def get_expected_value(self):
         return 'AES256'
 
     def get_expected_values(self):
-        return [self.get_expected_value(), 'aws:kms']
+        return [self.get_expected_value(), 'aws:kms', 'aws:kms:dsse']
 
 
 check = S3Encryption()

checkov/cloudformation/graph_builder/graph_components/generic_resource_encryption.py

@@ -83,6 +83,7 @@ def __init__(
         {
             "BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm": [
                 EncryptionTypes.AWS_KMS_VALUE.value,
+                EncryptionTypes.AWS_KMS_DSSE_VALUE.value,
                 EncryptionTypes.AES256.value,
             ],
             "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.KMSMasterKeyID": get_empty_list_str(),

checkov/common/graph/graph_builder/graph_components/attribute_names.py

@@ -54,3 +54,4 @@ class EncryptionTypes(str, Enum):
     DEFAULT_KMS = "Default KMS"
     AES256 = "AES256"
     AWS_KMS_VALUE = "aws:kms"
+    AWS_KMS_DSSE_VALUE = "aws:kms:dsse"

checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml

@@ -11,6 +11,7 @@ definition:
       operator: within
       value:
         - "aws:kms"
+        - "aws:kms:dsse"
         - "AES256"
     - and:
       - cond_type: filter
@@ -48,4 +49,5 @@ definition:
         operator: within
         value:
           - "aws:kms"
+          - "aws:kms:dsse"
           - "AES256"

checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml

@@ -8,8 +8,10 @@ definition:
       resource_types:
         - aws_s3_bucket
       attribute: server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm
-      operator: equals
-      value: "aws:kms"
+      operator: within
+      value:
+        - "aws:kms"
+        - "aws:kms:dsse"
     - and:
       - cond_type: filter
         attribute: resource_type
@@ -26,5 +28,7 @@ definition:
         resource_types:
           - aws_s3_bucket_server_side_encryption_configuration
         attribute: rule.apply_server_side_encryption_by_default.sse_algorithm
-        operator: equals
-        value: "aws:kms"
+        operator: within
+        value:
+          - "aws:kms"
+          - "aws:kms:dsse"

checkov/terraform/graph_builder/graph_components/generic_resource_encryption.py

@@ -111,6 +111,7 @@ def __init__(
         {
             "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm": [
                 EncryptionTypes.AWS_KMS_VALUE.value,
+                EncryptionTypes.AWS_KMS_DSSE_VALUE.value,
                 EncryptionTypes.AES256.value,
             ],
             "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id": get_empty_list_str(),

tests/cloudformation/checks/resource/aws/example_S3EncryptionDsse/DsseKms.yaml

@@ -0,0 +1,32 @@
+AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  PassDsseKms:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              KMSMasterKeyID: String
+              SSEAlgorithm: aws:kms:dsse
+  PassKms:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              KMSMasterKeyID: String
+              SSEAlgorithm: aws:kms
+  PassAes256:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+  FailUnknownAlgorithm:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: aws:kms:dss

tests/cloudformation/checks/resource/aws/test_S3Encryption.py

@@ -21,6 +21,30 @@ def test_summary(self):
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
 
+    def test_dsse_kms(self):
+        runner = Runner()
+        current_dir = os.path.dirname(os.path.realpath(__file__))
+
+        test_files_dir = current_dir + "/example_S3EncryptionDsse"
+        report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]))
+        summary = report.get_summary()
+
+        passing_resources = {
+            "AWS::S3::Bucket.PassDsseKms",
+            "AWS::S3::Bucket.PassKms",
+            "AWS::S3::Bucket.PassAes256",
+        }
+        failing_resources = {
+            "AWS::S3::Bucket.FailUnknownAlgorithm",
+        }
+
+        self.assertEqual(summary['passed'], 3)
+        self.assertEqual(summary['failed'], 1)
+        self.assertEqual(summary['skipped'], 0)
+        self.assertEqual(summary['parsing_errors'], 0)
+        self.assertEqual(passing_resources, {c.resource for c in report.passed_checks})
+        self.assertEqual(failing_resources, {c.resource for c in report.failed_checks})
+
 
 if __name__ == '__main__':
     unittest.main()

tests/terraform/graph/checks/resources/S3BucketEncryption/expected.yaml

@@ -5,9 +5,11 @@ pass:
   - "aws_s3_bucket.bucket_good_5"
   - "aws_s3_bucket.bucket_good_6"
   - "aws_s3_bucket.default_encryption_bucket"
+  - "aws_s3_bucket.bucket_good_dsse_inline"
+  - "aws_s3_bucket.bucket_good_dsse_sse"
 fail:
   - "aws_s3_bucket.bucket_bad_2"
   - "aws_s3_bucket.bucket_bad_3"
   - "aws_s3_bucket.bucket_bad_4"
   - "aws_s3_bucket.bucket_bad_5"
-  - "aws_s3_bucket.bucket_bad_6"
+  - "aws_s3_bucket.bucket_bad_6"

tests/terraform/graph/checks/resources/S3BucketEncryption/main.tf

@@ -192,4 +192,32 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "bad_sse_3" {
       }
     }
   }
-}
+}
+
+resource "aws_s3_bucket" "bucket_good_dsse_inline" {
+  bucket = "bucket_good_dsse_inline"
+
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        kms_master_key_id = aws_kms_key.mykey.arn
+        sse_algorithm     = "aws:kms:dsse"
+      }
+    }
+  }
+}
+
+resource "aws_s3_bucket" "bucket_good_dsse_sse" {
+  bucket = "bucket_good_dsse_sse"
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "good_sse_dsse" {
+  bucket = aws_s3_bucket.bucket_good_dsse_sse.bucket
+
+  rule {
+    apply_server_side_encryption_by_default {
+      kms_master_key_id = aws_kms_key.mykey.arn
+      sse_algorithm     = "aws:kms:dsse"
+    }
+  }
+}

tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/expected.yaml

@@ -2,10 +2,12 @@ pass:
   - "aws_s3_bucket.bucket_good_1"
   - "aws_s3_bucket.bucket_good_3"
   - "aws_s3_bucket.bucket_good_6"
+  - "aws_s3_bucket.bucket_good_dsse_inline"
+  - "aws_s3_bucket.bucket_good_dsse_sse"
 fail:
   - "aws_s3_bucket.bucket_bad_1"
   - "aws_s3_bucket.bucket_bad_2"
   - "aws_s3_bucket.bucket_bad_3"
   - "aws_s3_bucket.bucket_bad_4"
   - "aws_s3_bucket.bucket_bad_5"
-  - "aws_s3_bucket.bucket_bad_6"
+  - "aws_s3_bucket.bucket_bad_6"

tests/terraform/graph/checks/resources/S3KMSEncryptedByDefault/main.tf

@@ -162,4 +162,32 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "bad_sse_3" {
       }
     }
   }
-}
+}
+
+resource "aws_s3_bucket" "bucket_good_dsse_inline" {
+  bucket = "bucket_good_dsse_inline"
+
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        kms_master_key_id = aws_kms_key.mykey.arn
+        sse_algorithm     = "aws:kms:dsse"
+      }
+    }
+  }
+}
+
+resource "aws_s3_bucket" "bucket_good_dsse_sse" {
+  bucket = "bucket_good_dsse_sse"
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "good_sse_dsse" {
+  bucket = aws_s3_bucket.bucket_good_dsse_sse.bucket
+
+  rule {
+    apply_server_side_encryption_by_default {
+      kms_master_key_id = aws_kms_key.mykey.arn
+      sse_algorithm     = "aws:kms:dsse"
+    }
+  }
+}