feat: restore SNSEncryptedKMS to all rule packs except AwsSolutions (#…

…1853) Fixes #1849 Restored SNSEncryptedKMS rule that was removed in #1821 . Included the rule to [HIPAA Security](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-hipaa_security.html), [NIST 800-53 rev 4](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html), [NIST 800-53 rev 5](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_5.html), [PCI DSS 3.2.1](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-pci-dss.html) rule packs.
cdklabs · Jan 23, 2025 · c07e47e · c07e47e
1 parent 5f0d5a5
commit c07e47e
Show file tree

Hide file tree

Showing 9 changed files with 130 additions and 9 deletions.
diff --git a/RULES.md b/RULES.md
diff --git a/src/packs/hipaa-security.ts b/src/packs/hipaa-security.ts
@@ -124,6 +124,7 @@ import {
   SecretsManagerRotationEnabled,
   SecretsManagerUsingKMSKey,
 } from '../rules/secretsmanager';
+import { SNSEncryptedKMS } from '../rules/sns';
 import {
   VPCDefaultSecurityGroupClosed,
   VPCFlowLogsEnabled,
@@ -166,6 +167,7 @@ export class HIPAASecurityChecks extends NagPack {
       this.checkS3(node);
       this.checkSageMaker(node);
       this.checkSecretsManager(node);
+      this.checkSNS(node);
       this.checkVPC(node);
       this.checkWAF(node);
     }
@@ -1020,6 +1022,22 @@ export class HIPAASecurityChecks extends NagPack {
     });
   }
 
+  /**
+   * Check Amazon SNS Resources
+   * @param node the CfnResource to check
+   * @param ignores list of ignores for the resource
+   */
+  private checkSNS(node: CfnResource): void {
+    this.applyRule({
+      info: 'The SNS topic does not have KMS encryption enabled - (Control IDs: 164.312(a)(2)(iv), 164.312(e)(2)(ii)).',
+      explanation:
+        'Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.',
+      level: NagMessageLevel.ERROR,
+      rule: SNSEncryptedKMS,
+      node: node,
+    });
+  }
+
   /**
    * Check VPC Resources
    * @param node the CfnResource to check

diff --git a/src/packs/nist-800-53-r4.ts b/src/packs/nist-800-53-r4.ts
@@ -100,6 +100,7 @@ import {
   SageMakerNotebookInstanceKMSKeyConfigured,
   SageMakerNotebookNoDirectInternetAccess,
 } from '../rules/sagemaker';
+import { SNSEncryptedKMS } from '../rules/sns';
 import {
   VPCDefaultSecurityGroupClosed,
   VPCFlowLogsEnabled,
@@ -138,6 +139,7 @@ export class NIST80053R4Checks extends NagPack {
       this.checkRedshift(node);
       this.checkS3(node);
       this.checkSageMaker(node);
+      this.checkSNS(node);
       this.checkVPC(node);
       this.checkWAF(node);
     }
@@ -836,6 +838,22 @@ export class NIST80053R4Checks extends NagPack {
     });
   }
 
+  /**
+   * Check Amazon SNS Resources
+   * @param node the CfnResource to check
+   * @param ignores list of ignores for the resource
+   */
+  private checkSNS(node: CfnResource): void {
+    this.applyRule({
+      info: 'The SNS topic does not have KMS encryption enabled - (Control IDs: SC-13, SC-28).',
+      explanation:
+        'Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.',
+      level: NagMessageLevel.ERROR,
+      rule: SNSEncryptedKMS,
+      node: node,
+    });
+  }
+
   /**
    * Check VPC Resources
    * @param node the CfnResource to check

diff --git a/src/packs/nist-800-53-r5.ts b/src/packs/nist-800-53-r5.ts
@@ -117,6 +117,7 @@ import {
   SecretsManagerRotationEnabled,
   SecretsManagerUsingKMSKey,
 } from '../rules/secretsmanager';
+import { SNSEncryptedKMS } from '../rules/sns';
 import {
   VPCDefaultSecurityGroupClosed,
   VPCFlowLogsEnabled,
@@ -157,6 +158,7 @@ export class NIST80053R5Checks extends NagPack {
       this.checkS3(node);
       this.checkSageMaker(node);
       this.checkSecretsManager(node);
+      this.checkSNS(node);
       this.checkVPC(node);
       this.checkWAF(node);
     }
@@ -963,6 +965,22 @@ export class NIST80053R5Checks extends NagPack {
     });
   }
 
+  /**
+   * Check Amazon SNS Resources
+   * @param node the CfnResource to check
+   * @param ignores list of ignores for the resource
+   */
+  private checkSNS(node: CfnResource): void {
+    this.applyRule({
+      info: 'The SNS topic does not have KMS encryption enabled - (Control IDs: AU-9(3), CP-9d, SC-8(3), SC-8(4), SC-13a, SC-28(1)).',
+      explanation:
+        'To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS) Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.',
+      level: NagMessageLevel.ERROR,
+      rule: SNSEncryptedKMS,
+      node: node,
+    });
+  }
+
   /**
    * Check VPC Resources
    * @param node the CfnResource to check

diff --git a/src/packs/pci-dss-321.ts b/src/packs/pci-dss-321.ts
@@ -98,6 +98,7 @@ import {
   SageMakerNotebookNoDirectInternetAccess,
 } from '../rules/sagemaker';
 import { SecretsManagerUsingKMSKey } from '../rules/secretsmanager';
+import { SNSEncryptedKMS } from '../rules/sns';
 import {
   VPCDefaultSecurityGroupClosed,
   VPCFlowLogsEnabled,
@@ -137,6 +138,7 @@ export class PCIDSS321Checks extends NagPack {
       this.checkS3(node);
       this.checkSageMaker(node);
       this.checkSecretsManager(node);
+      this.checkSNS(node);
       this.checkVPC(node);
       this.checkWAF(node);
     }
@@ -807,6 +809,22 @@ export class PCIDSS321Checks extends NagPack {
     });
   }
 
+  /**
+   * Check Amazon SNS Resources
+   * @param node the CfnResource to check
+   * @param ignores list of ignores for the resource
+   */
+  private checkSNS(node: CfnResource): void {
+    this.applyRule({
+      info: 'The SNS topic does not have KMS encryption enabled - (Control ID: 8.2.1).',
+      explanation:
+        'To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS) Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.',
+      level: NagMessageLevel.ERROR,
+      rule: SNSEncryptedKMS,
+      node: node,
+    });
+  }
+
   /**
    * Check VPC Resources
    * @param node the CfnResource to check

diff --git a/src/rules/sns/SNSEncryptedKMS.ts b/src/rules/sns/SNSEncryptedKMS.ts
@@ -0,0 +1,28 @@
+/*
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
+import { parse } from 'path';
+import { CfnResource, Stack } from 'aws-cdk-lib';
+import { CfnTopic } from 'aws-cdk-lib/aws-sns';
+import { NagRuleCompliance } from '../../nag-rules';
+
+/**
+ * SNS topics are encrypted via KMS
+ * @param node the CfnResource to check
+ */
+export default Object.defineProperty(
+  (node: CfnResource): NagRuleCompliance => {
+    if (node instanceof CfnTopic) {
+      const topicKey = Stack.of(node).resolve(node.kmsMasterKeyId);
+      if (topicKey == undefined) {
+        return NagRuleCompliance.NON_COMPLIANT;
+      }
+      return NagRuleCompliance.COMPLIANT;
+    } else {
+      return NagRuleCompliance.NOT_APPLICABLE;
+    }
+  },
+  'name',
+  { value: parse(__filename).name }
+);
diff --git a/src/rules/sns/index.ts b/src/rules/sns/index.ts
@@ -2,4 +2,5 @@
 Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 SPDX-License-Identifier: Apache-2.0
 */
+export { default as SNSEncryptedKMS } from './SNSEncryptedKMS';
 export { default as SNSTopicSSLPublishOnly } from './SNSTopicSSLPublishOnly';
diff --git a/test/Packs.test.ts b/test/Packs.test.ts
@@ -288,6 +288,7 @@ describe('Check NagPack Details', () => {
         'HIPAA.Security-SageMakerNotebookNoDirectInternetAccess',
         'HIPAA.Security-SecretsManagerRotationEnabled',
         'HIPAA.Security-SecretsManagerUsingKMSKey',
+        'HIPAA.Security-SNSEncryptedKMS',
         'HIPAA.Security-VPCFlowLogsEnabled',
         'HIPAA.Security-VPCNoUnrestrictedRouteToIGW',
         'HIPAA.Security-VPCSubnetAutoAssignPublicIpDisabled',
@@ -391,6 +392,7 @@ describe('Check NagPack Details', () => {
         'NIST.800.53.R4-SageMakerEndpointConfigurationKMSKeyConfigured',
         'NIST.800.53.R4-SageMakerNotebookInstanceKMSKeyConfigured',
         'NIST.800.53.R4-SageMakerNotebookNoDirectInternetAccess',
+        'NIST.800.53.R4-SNSEncryptedKMS',
         'NIST.800.53.R4-VPCFlowLogsEnabled',
         'NIST.800.53.R4-WAFv2LoggingEnabled',
       ];
@@ -505,6 +507,7 @@ describe('Check NagPack Details', () => {
         'NIST.800.53.R5-SageMakerNotebookNoDirectInternetAccess',
         'NIST.800.53.R5-SecretsManagerRotationEnabled',
         'NIST.800.53.R5-SecretsManagerUsingKMSKey',
+        'NIST.800.53.R5-SNSEncryptedKMS',
         'NIST.800.53.R5-VPCFlowLogsEnabled',
         'NIST.800.53.R5-VPCNoUnrestrictedRouteToIGW',
         'NIST.800.53.R5-VPCSubnetAutoAssignPublicIpDisabled',
@@ -605,6 +608,7 @@ describe('Check NagPack Details', () => {
         'PCI.DSS.321-SageMakerNotebookInstanceKMSKeyConfigured',
         'PCI.DSS.321-SageMakerNotebookNoDirectInternetAccess',
         'PCI.DSS.321-SecretsManagerUsingKMSKey',
+        'PCI.DSS.321-SNSEncryptedKMS',
         'PCI.DSS.321-VPCFlowLogsEnabled',
         'PCI.DSS.321-VPCNoUnrestrictedRouteToIGW',
         'PCI.DSS.321-VPCSubnetAutoAssignPublicIpDisabled',

diff --git a/test/rules/SNS.test.ts b/test/rules/SNS.test.ts
@@ -13,9 +13,9 @@ import { Key } from 'aws-cdk-lib/aws-kms';
 import { CfnTopicPolicy, Topic } from 'aws-cdk-lib/aws-sns';
 import { Aspects, Stack } from 'aws-cdk-lib/core';
 import { validateStack, TestType, TestPack } from './utils';
-import { SNSTopicSSLPublishOnly } from '../../src/rules/sns';
+import { SNSEncryptedKMS, SNSTopicSSLPublishOnly } from '../../src/rules/sns';
 
-const testPack = new TestPack([SNSTopicSSLPublishOnly]);
+const testPack = new TestPack([SNSEncryptedKMS, SNSTopicSSLPublishOnly]);
 let stack: Stack;
 
 beforeEach(() => {
@@ -24,15 +24,27 @@ beforeEach(() => {
 });
 
 describe('Amazon Simple Notification Service (Amazon SNS)', () => {
+  describe('SNSEncryptedKMS: SNS topics are encrypted via KMS', () => {
+    const ruleId = 'SNSEncryptedKMS';
+    test('Noncompliance 1', () => {
+      new Topic(stack, 'Topic');
+      validateStack(stack, ruleId, TestType.NON_COMPLIANCE);
+    });
+    test('Compliance', () => {
+      new Topic(stack, 'Topic', { masterKey: new Key(stack, 'Key') });
+      validateStack(stack, ruleId, TestType.COMPLIANCE);
+    });
+  });
+
   describe('SNSTopicSSLPublishOnly: SNS topics require SSL requests for publishing', () => {
     const ruleId = 'SNSTopicSSLPublishOnly';
     test('Noncompliance 1', () => {
-      new Topic(stack, 'rTopic');
+      new Topic(stack, 'Topic');
       validateStack(stack, ruleId, TestType.NON_COMPLIANCE);
     });
     test('Noncompliance 2', () => {
-      new Topic(stack, 'rTopic', { topicName: 'foo' });
-      new CfnTopicPolicy(stack, 'rTopicPolicy', {
+      new Topic(stack, 'Topic', { topicName: 'foo' });
+      new CfnTopicPolicy(stack, 'TopicPolicy', {
         topics: ['foo'],
         policyDocument: new PolicyDocument({
           statements: [
@@ -49,9 +61,9 @@ describe('Amazon Simple Notification Service (Amazon SNS)', () => {
       validateStack(stack, ruleId, TestType.NON_COMPLIANCE);
     });
     test('Compliance', () => {
-      new Topic(stack, 'rTopic', { topicName: 'foo' });
-      new Topic(stack, 'rTopic2', { masterKey: new Key(stack, 'rKey') });
-      new Topic(stack, 'rTopic3').addToResourcePolicy(
+      new Topic(stack, 'Topic', { topicName: 'foo' });
+      new Topic(stack, 'Topic2', { masterKey: new Key(stack, 'Key') });
+      new Topic(stack, 'Topic3').addToResourcePolicy(
         new PolicyStatement({
           actions: ['sns:publish', 'sns:subscribe'],
           effect: Effect.DENY,
@@ -60,7 +72,7 @@ describe('Amazon Simple Notification Service (Amazon SNS)', () => {
           resources: ['foo'],
         })
       );
-      new CfnTopicPolicy(stack, 'rTopicPolicy', {
+      new CfnTopicPolicy(stack, 'TopicPolicy', {
         topics: ['foo'],
         policyDocument: new PolicyDocument({
           statements: [