kyverno-policies/terraform/plan/s3-best-practices/enable-kms-encryption/enable-kms-encryption.yaml at main · nirmata/kyverno-policies · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
apiVersion: policies.kyverno.io/v1alpha1
kind: ValidatingPolicy
metadata:
  name: s3-enable-kms-encryption
  annotations:
    policies.kyverno.io/title: S3 Enable KMS Encryption
    policies.kyverno.io/category: AWS S3 Security Best Practices
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: >-
      All Amazon S3 buckets have encryption configured by default,
      and all new objects that are uploaded to an S3 bucket are automatically
      encrypted at rest. Server-side encryption with Amazon S3 managed keys (SSE-S3)
      is the default encryption configuration for every bucket in Amazon S3. To use a
      different type of encryption, you can either specify the type of server-side encryption
      to use in your S3 PUT requests, or you can set the default encryption configuration in
      the destination bucket.
spec:
  validationActions:
    - Deny
  evaluation:
    mode: JSON
    background:
      enabled: false
  matchConstraints:
    resourceRules:
      - apiGroups: ["*"]
        apiVersions: ["*"]
        resources: ["*"]
        operations: ["CREATE", "UPDATE"]
  matchConditions:
    - name: is-terraform-plan
      expression: "has(object.planned_values) && has(object.terraform_version)"
    - name: has-s3-bucket
      expression: "has(object.planned_values) && has(object.planned_values.root_module) && has(object.planned_values.root_module.resources) && object.planned_values.root_module.resources.exists(r, r.type == 'aws_s3_bucket')"
  validations:
    - expression: |
        object.planned_values.root_module.resources.exists(r, r.type == 'aws_s3_bucket_server_side_encryption_configuration')
      message: "Use the 'aws_s3_bucket_server_side_encryption_configuration' resource to set the S3 server side encryption to KMS"
    - expression: |
        object.planned_values.root_module.resources.filter(r, r.type == 'aws_s3_bucket_server_side_encryption_configuration').all(encryption,
          has(encryption.values.rule) &&
          encryption.values.rule != null &&
          encryption.values.rule.exists(rule,
            has(rule.apply_server_side_encryption_by_default) &&
            rule.apply_server_side_encryption_by_default != null &&
            rule.apply_server_side_encryption_by_default.exists(defaultEnc,
              has(defaultEnc.sse_algorithm) &&
              defaultEnc.sse_algorithm == 'aws:kms'
            )
          )
        )
      message: "S3 server side encryption is not set to KMS"