feat: checks for awscc provider resources

checkov/terraform/checks/resource/awscc/BackupVaultEncrypted.py

@@ -0,0 +1,25 @@
+from typing import Any
+
+from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import (
+    BaseResourceValueCheck,
+)
+
+
+class BackupVaultEncrypted(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure Backup Vault is encrypted at rest using KMS CMK"
+        id = "CKV_AWS_166"
+        supported_resources = ("awscc_backup_backup_vault",)
+        categories = (CheckCategories.ENCRYPTION,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self) -> str:
+        return "encryption_key_arn"
+
+    def get_expected_value(self) -> Any:
+        return ANY_VALUE
+
+
+check = BackupVaultEncrypted()

checkov/terraform/checks/resource/awscc/BedrockAgentEncrypted.py

@@ -0,0 +1,25 @@
+from typing import Any
+
+from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import (
+    BaseResourceValueCheck,
+)
+
+
+class BedrockAgentEncrypted(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure Bedrock Agent is encrypted with a CMK"
+        id = "CKV_AWS_373"
+        supported_resources = ("awscc_bedrock_agent",)
+        categories = (CheckCategories.ENCRYPTION,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self) -> str:
+        return "customer_encryption_key_arn"
+
+    def get_expected_value(self) -> Any:
+        return ANY_VALUE
+
+
+check = BedrockAgentEncrypted()

checkov/terraform/checks/resource/awscc/BedrockGuardrails.py

@@ -0,0 +1,25 @@
+from typing import Any
+
+from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import (
+    BaseResourceValueCheck,
+)
+
+
+class BedrockGuardrails(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure AWS Bedrock agent is associated with Bedrock guardrails"
+        id = "CKV_AWS_383"
+        supported_resources = ("awscc_bedrock_agent",)
+        categories = (CheckCategories.AI_AND_ML,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self) -> str:
+        return "guardrail_configuration/[0]/guardrail_identifier"
+
+    def get_expected_value(self) -> Any:
+        return ANY_VALUE
+
+
+check = BedrockGuardrails()

checkov/terraform/checks/resource/awscc/CloudtrailLogValidation.py

@@ -0,0 +1,19 @@
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import (
+    BaseResourceValueCheck,
+)
+
+
+class CloudtrailLogValidation(BaseResourceValueCheck):
+    def __init__(self):
+        name = "Ensure CloudTrail log file validation is enabled"
+        id = "CKV_AWS_36"
+        supported_resources = ['awscc_cloudtrail_trail']
+        categories = [CheckCategories.LOGGING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "enable_log_file_validation"
+
+
+check = CloudtrailLogValidation()

checkov/terraform/checks/resource/awscc/KMSKeyIsEnabled.py

@@ -0,0 +1,20 @@
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import (
+    BaseResourceValueCheck,
+)
+
+
+class KMSKeyIsEnabled(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure KMS key is enabled"
+        id = "CKV_AWS_227"
+        supported_resources = ('awscc_kms_key',)
+        categories = (CheckCategories.ENCRYPTION,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
+                         missing_block_result=CheckResult.PASSED)
+
+    def get_inspected_key(self) -> str:
+        return "enabled"
+
+
+check = KMSKeyIsEnabled()

checkov/terraform/checks/resource/awscc/KMSRotation.py

@@ -0,0 +1,27 @@
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.terraform.checks.resource.base_resource_value_check import (
+    BaseResourceValueCheck,
+)
+
+
+class KMSRotation(BaseResourceValueCheck):
+    def __init__(self):
+        name = "Ensure rotation for customer created CMKs is enabled"
+        id = "CKV_AWS_7"
+        supported_resources = ['awscc_kms_key']
+        categories = [CheckCategories.ENCRYPTION]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self):
+        return "enable_key_rotation"
+
+    def scan_resource_conf(self, conf):
+        # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric.
+        spec = conf.get('key_spec')
+        if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec:
+            return super().scan_resource_conf(conf)
+        else:
+            return CheckResult.UNKNOWN
+
+
+check = KMSRotation()

checkov/terraform/checks/resource/awscc/SNSTopicEncryption.py

@@ -0,0 +1,25 @@
+from typing import Any
+
+from checkov.common.models.consts import ANY_VALUE
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import (
+    BaseResourceValueCheck,
+)
+
+
+class SNSTopicEncryption(BaseResourceValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure all data stored in the SNS topic is encrypted"
+        id = "CKV_AWS_26"
+        supported_resources = ("awscc_sns_topic",)
+        categories = (CheckCategories.ENCRYPTION,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_inspected_key(self) -> str:
+        return "kms_master_key_id"
+
+    def get_expected_value(self) -> Any:
+        return ANY_VALUE
+
+
+check = SNSTopicEncryption()

checkov/terraform/checks/resource/awscc/SubnetPublicIP.py

@@ -0,0 +1,22 @@
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_negative_value_check import (
+    BaseResourceNegativeValueCheck,
+)
+
+
+class SubnetPublicIP(BaseResourceNegativeValueCheck):
+    def __init__(self):
+        name = "Ensure VPC subnets do not assign public IP by default"
+        id = "CKV_AWS_130"
+        supported_resources = ['awscc_ec2_subnet']
+        categories = [CheckCategories.NETWORKING]
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
+
+    def get_forbidden_values(self):
+        return [True]
+
+    def get_inspected_key(self):
+        return "map_public_ip_on_launch"
+
+
+check = SubnetPublicIP()

checkov/terraform/checks/resource/awscc/__init__.py

@@ -0,0 +1,5 @@
+from os.path import dirname, basename, isfile, join
+import glob
+
+modules = glob.glob(join(dirname(__file__), "*.py"))
+__all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")]

tests/terraform/checks/resource/awscc/example_BackupVaultEncrypted/main.tf

@@ -0,0 +1,8 @@
+resource "awscc_backup_backup_vault" "pass" {
+  backup_vault_name  = "pass"
+  encryption_key_arn = awscc_kms_key.example.arn
+}
+
+resource "awscc_backup_backup_vault" "fail" {
+  backup_vault_name  = "fail"
+}

tests/terraform/checks/resource/awscc/example_BedrockAgentEncrypted/main.tf

@@ -0,0 +1,14 @@
+resource "awscc_bedrock_agent" "pass" {
+  agent_name = "pass"
+  instruction      = "You are a helpful assistant that provides information about our company's products."
+  foundation_model = "anthropic.claude-v2"
+  customer_encryption_key_arn = awscc_kms_key.example.arn
+}
+
+resource "awscc_bedrock_agent" "fail" {
+  agent_name = "fail"
+  instruction      = "You are a helpful assistant that provides information about our company's products."
+  foundation_model = "anthropic.claude-v2"
+
+
+}

tests/terraform/checks/resource/awscc/example_BedrockGuardrails/main.tf

@@ -0,0 +1,36 @@
+resource "awscc_bedrock_agent" "pass" {
+  agent_name = "pass"
+  instruction      = "You are a helpful assistant that provides information about our company's products."
+  foundation_model = "anthropic.claude-v2"
+
+  guardrail_configuration= {
+    guardrail_identifier = awscc_bedrock_guardrail.example.id
+  }
+}
+
+resource "awscc_bedrock_agent" "fail" {
+  agent_name = "fail"
+  instruction      = "You are a helpful assistant that provides information about our company's products."
+  foundation_model = "anthropic.claude-v2"
+
+}
+
+resource "awscc_bedrock_guardrail" "example" {
+  name                      = "example_guardrail"
+  blocked_input_messaging   = "Blocked input"
+  blocked_outputs_messaging = "Blocked output"
+  description               = "Example guardrail"
+
+  content_policy_config = {
+    filters_config = [
+      {
+        input_strength  = "MEDIUM"
+        output_strength = "MEDIUM"
+        type            = "HATE"
+      }
+    ]
+  }
+
+
+
+}

tests/terraform/checks/resource/awscc/example_CloudtrailLogValidation/main.tf

@@ -0,0 +1,20 @@
+resource "awscc_cloudtrail_trail" "pass" {
+  trail_name                 = "pass"
+  is_logging                 = true
+  s3_bucket_name             = awscc_s3_bucket.example.id
+  enable_log_file_validation = true
+
+}
+
+resource "awscc_cloudtrail_trail" "fail" {
+  trail_name                 = "fail"
+  is_logging                 = true
+  s3_bucket_name             = awscc_s3_bucket.example.id
+  enable_log_file_validation = false
+}
+
+resource "awscc_cloudtrail_trail" "fail2" {
+  trail_name     = "fail2"
+  is_logging     = true
+  s3_bucket_name = awscc_s3_bucket.example.id
+}

tests/terraform/checks/resource/awscc/example_KMSKeyIsEnabled/main.tf

@@ -0,0 +1,67 @@
+resource "awscc_kms_key" "pass" {
+  description            = "KMS Key for root"
+  enabled                = "true"
+  pending_window_in_days = 30
+  key_policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Id" : "KMS-Key-Policy-For-Root",
+    "Statement" : [
+      {
+        "Sid" : "Enable IAM User Permissions",
+        "Effect" : "Allow",
+        "Principal" : {
+          "AWS" : "arn:aws:iam::111122223333:root"
+        },
+        "Action" : "kms:*",
+        "Resource" : "*"
+      },
+    ],
+    },
+  )
+
+}
+
+resource "awscc_kms_key" "pass2" {
+  description            = "KMS Key for root"
+  pending_window_in_days = 30
+  key_policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Id" : "KMS-Key-Policy-For-Root",
+    "Statement" : [
+      {
+        "Sid" : "Enable IAM User Permissions",
+        "Effect" : "Allow",
+        "Principal" : {
+          "AWS" : "arn:aws:iam::111122223333:root"
+        },
+        "Action" : "kms:*",
+        "Resource" : "*"
+      },
+    ],
+    },
+  )
+
+}
+
+resource "awscc_kms_key" "fail" {
+  description            = "KMS Key for root"
+  enabled                = "false"
+  pending_window_in_days = 30
+  key_policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Id" : "KMS-Key-Policy-For-Root",
+    "Statement" : [
+      {
+        "Sid" : "Enable IAM User Permissions",
+        "Effect" : "Allow",
+        "Principal" : {
+          "AWS" : "arn:aws:iam::111122223333:root"
+        },
+        "Action" : "kms:*",
+        "Resource" : "*"
+      },
+    ],
+    },
+  )
+
+}

tests/terraform/checks/resource/awscc/example_KMSRotation/main.tf

@@ -0,0 +1,36 @@
+resource "awscc_kms_key" "pass1" {
+  description             = "KMS key 1"
+  pending_window_in_days = 10
+  enable_key_rotation     = true
+}
+
+resource "awscc_kms_key" "pass2" {
+  description              = "KMS key 1"
+  pending_window_in_days  = 10
+  key_spec = "SYMMETRIC_DEFAULT"
+  enable_key_rotation      = true
+}
+
+resource "awscc_kms_key" "fail1" {
+  description             = "KMS key 1"
+  pending_window_in_days = 10
+}
+
+resource "awscc_kms_key" "fail2" {
+  description             = "KMS key 1"
+  pending_window_in_days = 10
+  enable_key_rotation     = false
+}
+
+resource "awscc_kms_key" "fail3" {
+  description              = "KMS key 1"
+  pending_window_in_days  = 10
+  key_spec = "SYMMETRIC_DEFAULT"
+  enable_key_rotation      = false
+}
+
+resource "awscc_kms_key" "fail4" {
+  description              = "KMS key 1"
+  pending_window_in_days  = 10
+  key_spec = "SYMMETRIC_DEFAULT"
+}