rds should be encrypted

Author: chrisns

infra/checkov/rds-should-be-encrypted/fail0.tf

@@ -0,0 +1,11 @@
+resource "aws_db_instance" "default" {
+  allocated_storage    = 10
+  engine               = "mysql"
+  engine_version       = "5.7"
+  instance_class       = "db.t3.micro"
+  name                 = "mydb"
+  username             = "foo"
+  password             = "foobarbaz"
+  parameter_group_name = "default.mysql5.7"
+  skip_final_snapshot  = true
+}

infra/checkov/rds-should-be-encrypted/fail1.tf

@@ -0,0 +1,9 @@
+resource "aws_db_instance" "default" {
+  allocated_storage    = 10
+  engine               = "postgresql"
+  instance_class       = "db.t3.micro"
+  name                 = "mydb"
+  username             = "foo"
+  password             = "foobarbaz"
+  skip_final_snapshot  = true
+}

infra/checkov/rds-should-be-encrypted/fail2.tf

@@ -0,0 +1,10 @@
+resource "aws_db_instance" "default" {
+  allocated_storage    = 10
+  engine               = "postgresql"
+  instance_class       = "db.t3.micro"
+  name                 = "mydb"
+  username             = "foo"
+  password             = "foobarbaz"
+  skip_final_snapshot  = true
+  storage_encrypted    = false
+}

infra/checkov/rds-should-be-encrypted/pass0.tf

@@ -0,0 +1,12 @@
+resource "aws_db_instance" "default" {
+  allocated_storage    = 10
+  engine               = "mysql"
+  engine_version       = "5.7"
+  instance_class       = "db.t3.micro"
+  name                 = "mydb"
+  username             = "foo"
+  password             = "foobarbaz"
+  parameter_group_name = "default.mysql5.7"
+  skip_final_snapshot  = true
+  storage_encrypted    = true
+}

infra/checkov/rds-should-be-encrypted/pass1.tf

@@ -0,0 +1,10 @@
+resource "aws_db_instance" "default" {
+  allocated_storage    = 10
+  engine               = "postgresql"
+  instance_class       = "db.t3.micro"
+  name                 = "mydb"
+  username             = "foo"
+  password             = "foobarbaz"
+  skip_final_snapshot  = true
+  storage_encrypted    = true
+}

infra/checkov/rds-should-be-encrypted/policy.yaml

@@ -0,0 +1,14 @@
+metadata:
+  name: "Check that databases are encrypted"
+  id: "CUSTOM_AWS_1"
+  category: "ENCRYPTION"
+scope:
+  provider: aws
+definition:
+  and:
+    - cond_type: "attribute"
+      resource_types: 
+      - "aws_db_instance"
+      attribute: "storage_encrypted"
+      operator: "equals"
+      value: "true"