-
Notifications
You must be signed in to change notification settings - Fork 307
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #6619 from Checkmarx/kics-785-cloudformation
feat(query): cloudformation DynamoDB Table Not Encrypted
- Loading branch information
Showing
11 changed files
with
188 additions
and
0 deletions.
There are no files selected for viewing
11 changes: 11 additions & 0 deletions
11
...s/queries/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/metadata.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
{ | ||
"id": "0f04217d-488f-4e7a-bec8-f16159686cd6", | ||
"queryName": "DynamoDB Table Point In Time Recovery Disabled", | ||
"severity": "MEDIUM", | ||
"category": "Best Practices", | ||
"descriptionText": "It's considered a best practice to have point in time recovery enabled for DynamoDB Table", | ||
"descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-dynamodb-table-pointintimerecoveryspecification.html", | ||
"platform": "CloudFormation", | ||
"descriptionID": "a0a51171", | ||
"cloudProvider": "aws" | ||
} |
62 changes: 62 additions & 0 deletions
62
assets/queries/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/query.rego
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,62 @@ | ||
package Cx | ||
|
||
import data.generic.common as common_lib | ||
import data.generic.cloudformation as cf_lib | ||
|
||
CxPolicy[result] { | ||
document := input.document[i] | ||
resource := document.Resources[key] | ||
resource.Type == "AWS::DynamoDB::Table" | ||
properties := resource.Properties | ||
|
||
properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled == false | ||
|
||
result := { | ||
"documentId": input.document[i].id, | ||
"resourceType": resource.Type, | ||
"resourceName": cf_lib.get_resource_name(resource, key), | ||
"searchKey": sprintf("Resources.%s.Properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled", [key]), | ||
"issueType": "IncorrectValue", | ||
"keyExpectedValue": sprintf("Resources[%s].Properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled should be set to 'true'", [key]), | ||
"keyActualValue": sprintf("Resources[%s].Properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled is set to 'false'", [key]), | ||
} | ||
} | ||
|
||
CxPolicy[result] { | ||
document := input.document[i] | ||
resource := document.Resources[key] | ||
resource.Type == "AWS::DynamoDB::Table" | ||
properties := resource.Properties | ||
|
||
not common_lib.valid_key(properties, "PointInTimeRecoverySpecification") | ||
|
||
result := { | ||
"documentId": input.document[i].id, | ||
"resourceType": resource.Type, | ||
"resourceName": cf_lib.get_resource_name(resource, key), | ||
"searchKey": sprintf("Resources.%s.Properties", [key]), | ||
"issueType": "MissingAttribute", | ||
"keyExpectedValue": sprintf("Resources[%s].Properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled should be defined and set to 'true'", [key]), | ||
"keyActualValue": sprintf("Resources[%s].Properties.PointInTimeRecoverySpecification is not defined", [key]), | ||
} | ||
} | ||
|
||
CxPolicy[result] { | ||
document := input.document[i] | ||
resource := document.Resources[key] | ||
resource.Type == "AWS::DynamoDB::Table" | ||
properties := resource.Properties | ||
specification := properties.PointInTimeRecoverySpecification | ||
|
||
not common_lib.valid_key(specification, "PointInTimeRecoveryEnabled") | ||
|
||
result := { | ||
"documentId": input.document[i].id, | ||
"resourceType": resource.Type, | ||
"resourceName": cf_lib.get_resource_name(resource, key), | ||
"searchKey": sprintf("Resources.%s.Properties.PointInTimeRecoverySpecification", [key]), | ||
"issueType": "MissingAttribute", | ||
"keyExpectedValue": sprintf("Resources[%s].Properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled should be defined and set to 'true'", [key]), | ||
"keyActualValue": sprintf("Resources[%s].Properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled is not defined", [key]), | ||
} | ||
} |
6 changes: 6 additions & 0 deletions
6
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/negative1.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
Resources: | ||
MyDynamoDBTable: | ||
Type: AWS::DynamoDB::Table | ||
Properties: | ||
PointInTimeRecoverySpecification: | ||
PointInTimeRecoveryEnabled: true |
15 changes: 15 additions & 0 deletions
15
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/negative2.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
{ | ||
"Resources": { | ||
"DynamoDBOnDemandTable1": { | ||
"Type": "AWS::DynamoDB::Table", | ||
"Properties": { | ||
"BillingMode": "PAY_PER_REQUEST", | ||
"PointInTimeRecoverySpecification" : { | ||
"PointInTimeRecoveryEnabled" : true | ||
} | ||
} | ||
}, | ||
"AWSTemplateFormatVersion": "2010-09-09", | ||
"Description": "Sample CloudFormation template for DynamoDB with customer managed CMK" | ||
} | ||
} |
6 changes: 6 additions & 0 deletions
6
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/positive1.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
Resources: | ||
MyDynamoDBTable: | ||
Type: AWS::DynamoDB::Table | ||
Properties: | ||
PointInTimeRecoverySpecification: | ||
PointInTimeRecoveryEnabled: false |
5 changes: 5 additions & 0 deletions
5
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/positive2.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
Resources: | ||
MyDynamoDBTable: | ||
Type: AWS::DynamoDB::Table | ||
Properties: | ||
TableName: my-table |
15 changes: 15 additions & 0 deletions
15
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/positive3.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
{ | ||
"Resources": { | ||
"DynamoDBOnDemandTable1": { | ||
"Type": "AWS::DynamoDB::Table", | ||
"Properties": { | ||
"BillingMode": "PAY_PER_REQUEST", | ||
"PointInTimeRecoverySpecification" : { | ||
"PointInTimeRecoveryEnabled" : false | ||
} | ||
} | ||
}, | ||
"AWSTemplateFormatVersion": "2010-09-09", | ||
"Description": "Sample CloudFormation template for DynamoDB with customer managed CMK" | ||
} | ||
} |
12 changes: 12 additions & 0 deletions
12
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/positive4.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
{ | ||
"Resources": { | ||
"DynamoDBOnDemandTable1": { | ||
"Type": "AWS::DynamoDB::Table", | ||
"Properties": { | ||
"BillingMode": "PAY_PER_REQUEST" | ||
} | ||
}, | ||
"AWSTemplateFormatVersion": "2010-09-09", | ||
"Description": "Sample CloudFormation template for DynamoDB with customer managed CMK" | ||
} | ||
} |
5 changes: 5 additions & 0 deletions
5
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/positive5.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
Resources: | ||
MyDynamoDBTable: | ||
Type: AWS::DynamoDB::Table | ||
Properties: | ||
PointInTimeRecoverySpecification: {} |
13 changes: 13 additions & 0 deletions
13
...ies/cloudFormation/aws/dynamodb_table_point_in_time_recovery_disabled/test/positive6.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
{ | ||
"Resources": { | ||
"DynamoDBOnDemandTable1": { | ||
"Type": "AWS::DynamoDB::Table", | ||
"Properties": { | ||
"BillingMode": "PAY_PER_REQUEST", | ||
"PointInTimeRecoverySpecification" : {} | ||
} | ||
}, | ||
"AWSTemplateFormatVersion": "2010-09-09", | ||
"Description": "Sample CloudFormation template for DynamoDB with customer managed CMK" | ||
} | ||
} |
38 changes: 38 additions & 0 deletions
38
...ion/aws/dynamodb_table_point_in_time_recovery_disabled/test/positive_expected_result.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,38 @@ | ||
[ | ||
{ | ||
"queryName": "DynamoDB Table Point In Time Recovery Disabled", | ||
"severity": "MEDIUM", | ||
"line": 6, | ||
"filename": "positive1.yaml" | ||
}, | ||
{ | ||
"queryName": "DynamoDB Table Point In Time Recovery Disabled", | ||
"severity": "MEDIUM", | ||
"line": 4, | ||
"filename": "positive2.yaml" | ||
}, | ||
{ | ||
"queryName": "DynamoDB Table Point In Time Recovery Disabled", | ||
"severity": "MEDIUM", | ||
"line": 8, | ||
"filename": "positive3.json" | ||
}, | ||
{ | ||
"queryName": "DynamoDB Table Point In Time Recovery Disabled", | ||
"severity": "MEDIUM", | ||
"line": 5, | ||
"filename": "positive4.json" | ||
}, | ||
{ | ||
"queryName": "DynamoDB Table Point In Time Recovery Disabled", | ||
"severity": "MEDIUM", | ||
"line": 5, | ||
"filename": "positive5.yaml" | ||
}, | ||
{ | ||
"queryName": "DynamoDB Table Point In Time Recovery Disabled", | ||
"severity": "MEDIUM", | ||
"line": 7, | ||
"filename": "positive6.json" | ||
} | ||
] |