Skip to content

Commit 54193d6

Browse files
author
Michael Schappacher
committed
Added new rules for DMS Endpoint Encryption and AWS EMR Cluster Logging
1 parent 5c6d176 commit 54193d6

File tree

6 files changed

+220
-0
lines changed

6 files changed

+220
-0
lines changed

‎cli/assets/terraform.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -799,6 +799,8 @@ rules:
799799
assertions:
800800
- key: kms_key_id
801801
op: present
802+
tags:
803+
- kinesis
802804

803805
- id: REDSHIFT_CLUSTER_ENCRYPTION
804806
message: RedshiftCluster should use encryption
@@ -884,6 +886,8 @@ rules:
884886
- key: policy.Version
885887
op: eq
886888
value: "2012-10-17"
889+
tags:
890+
- iam
887891

888892
- id: ASSUME_ROLEPOLICY_VERSION
889893
message: Version in IAM Policy should be 2012-10-17
@@ -893,6 +897,8 @@ rules:
893897
- key: assume_role_policy.Version
894898
op: eq
895899
value: "2012-10-17"
900+
tags:
901+
- iam
896902

897903
- id: BATCH_DEFINITION_PRIVILEGED
898904
message: Batch Job Definition Container Properties should not have Privileged set to true
@@ -902,6 +908,8 @@ rules:
902908
- not:
903909
- key: container_properties.privileged
904910
op: is-true
911+
tags:
912+
- batch
905913

906914
- id: EC2_SUBNET_MAP_PUBLIC
907915
message: EC2 Subnet should not have MapPublicIpOnLaunch set to true
@@ -911,6 +919,9 @@ rules:
911919
- not:
912920
- key: map_public_ip_on_launch
913921
op: is-true
922+
tags:
923+
- ec2
924+
- subnet
914925

915926
- id: ELASTICACHE_ENCRYPTION_REST
916927
message: ElastiCache ReplicationGroup should have encryption enabled for at rest
@@ -919,6 +930,8 @@ rules:
919930
assertions:
920931
- key: at_rest_encryption_enabled
921932
op: is-true
933+
tags:
934+
- elasticache
922935

923936
- id: ELASTICACHE_ENCRYPTION_TRANSIT
924937
message: ElastiCache ReplicationGroup should have encryption enabled for in transit
@@ -927,6 +940,8 @@ rules:
927940
assertions:
928941
- key: transit_encryption_enabled
929942
op: is-true
943+
tags:
944+
- elasticache
930945

931946
- id: NEPTUNE_DB_ENCRYPTION
932947
message: Neptune database cluster storage should have encryption enabled
@@ -935,6 +950,8 @@ rules:
935950
assertions:
936951
- key: storage_encrypted
937952
op: is-true
953+
tags:
954+
- neptune
938955

939956
- id: RDS_PUBLIC_AVAILABILITY
940957
message: RDS instance should not be publicly accessible
@@ -944,6 +961,28 @@ rules:
944961
- not:
945962
- key: publicly_accessible
946963
op: is-true
964+
tags:
965+
- rds
966+
967+
- id: AWS_DMS_ENDPOINT_ENCRYPTION
968+
message: AWS DMS Endpoint should have a kms key present
969+
resource: aws_dms_endpoint
970+
severity: WARNING
971+
assertions:
972+
- key: kms_key_arn
973+
op: present
974+
tags:
975+
- dms
976+
977+
- id: AWS_EMR_CLUSTER_LOGGING
978+
message: AWS EMR Should have logging enabled
979+
resource: aws_emr_cluster
980+
severity: WARNING
981+
assertions:
982+
- key: log_uri
983+
op: present
984+
tags:
985+
- emr
947986
# add KMS key policy version
948987
# ECR repository policy
949988
# add ElasticSearch domain access policy version

‎linter/terraform_test.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,18 @@ func TestTerraformLinterCases(t *testing.T) {
234234
1,
235235
"KINESIS_STREAM_KMS",
236236
},
237+
"DmsEncryption": {
238+
"./testdata/resources/dms_endpoint_encryption.tf",
239+
"./testdata/rules/dms_endpoint_encryption.yml",
240+
0,
241+
"",
242+
},
243+
"EmrClusterLogs": {
244+
"./testdata/resources/emr_cluster_logs.tf",
245+
"./testdata/rules/emr_cluster_logs.yml",
246+
1,
247+
"AWS_EMR_CLUSTER_LOGGING",
248+
},
237249
}
238250
for name, tc := range testCases {
239251
options := Options{

‎linter/testdata/resources/dms_endpoint_encryption.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "aws_dms_endpoint" "test" {
2+
certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
3+
database_name = "test"
4+
endpoint_id = "test-dms-endpoint-tf"
5+
endpoint_type = "source"
6+
engine_name = "aurora"
7+
extra_connection_attributes = ""
8+
kms_key_arn = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
9+
password = "test"
10+
port = 3306
11+
server_name = "test"
12+
ssl_mode = "none"
13+
14+
tags = {
15+
Name = "test"
16+
}
17+
18+
username = "test"
19+
}

‎linter/testdata/resources/emr_cluster_logs.tf‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
resource "aws_emr_cluster" "cluster" {
2+
name = "emr-test-arn"
3+
release_label = "emr-4.6.0"
4+
applications = ["Spark"]
5+
6+
additional_info = <<EOF
7+
{
8+
"instanceAwsClientConfiguration": {
9+
"proxyPort": 8099,
10+
"proxyHost": "myproxy.example.com"
11+
}
12+
}
13+
EOF
14+
15+
termination_protection = false
16+
keep_job_flow_alive_when_no_steps = true
17+
18+
ec2_attributes {
19+
subnet_id = "${aws_subnet.main.id}"
20+
emr_managed_master_security_group = "${aws_security_group.sg.id}"
21+
emr_managed_slave_security_group = "${aws_security_group.sg.id}"
22+
instance_profile = "${aws_iam_instance_profile.emr_profile.arn}"
23+
}
24+
25+
master_instance_group {
26+
instance_type = "m4.large"
27+
}
28+
29+
core_instance_group {
30+
instance_type = "c4.large"
31+
instance_count = 1
32+
33+
ebs_config {
34+
size = "40"
35+
type = "gp2"
36+
volumes_per_instance = 1
37+
}
38+
39+
bid_price = "0.30"
40+
41+
autoscaling_policy = <<EOF
42+
{
43+
"Constraints": {
44+
"MinCapacity": 1,
45+
"MaxCapacity": 2
46+
},
47+
"Rules": [
48+
{
49+
"Name": "ScaleOutMemoryPercentage",
50+
"Description": "Scale out if YARNMemoryAvailablePercentage is less than 15",
51+
"Action": {
52+
"SimpleScalingPolicyConfiguration": {
53+
"AdjustmentType": "CHANGE_IN_CAPACITY",
54+
"ScalingAdjustment": 1,
55+
"CoolDown": 300
56+
}
57+
},
58+
"Trigger": {
59+
"CloudWatchAlarmDefinition": {
60+
"ComparisonOperator": "LESS_THAN",
61+
"EvaluationPeriods": 1,
62+
"MetricName": "YARNMemoryAvailablePercentage",
63+
"Namespace": "AWS/ElasticMapReduce",
64+
"Period": 300,
65+
"Statistic": "AVERAGE",
66+
"Threshold": 15.0,
67+
"Unit": "PERCENT"
68+
}
69+
}
70+
}
71+
]
72+
}
73+
EOF
74+
}
75+
76+
ebs_root_volume_size = 100
77+
78+
tags = {
79+
role = "rolename"
80+
env = "env"
81+
}
82+
83+
bootstrap_action {
84+
path = "s3://elasticmapreduce/bootstrap-actions/run-if"
85+
name = "runif"
86+
args = ["instance.isMaster=true", "echo running on master node"]
87+
}
88+
89+
configurations_json = <<EOF
90+
[
91+
{
92+
"Classification": "hadoop-env",
93+
"Configurations": [
94+
{
95+
"Classification": "export",
96+
"Properties": {
97+
"JAVA_HOME": "/usr/lib/jvm/java-1.8.0"
98+
}
99+
}
100+
],
101+
"Properties": {}
102+
},
103+
{
104+
"Classification": "spark-env",
105+
"Configurations": [
106+
{
107+
"Classification": "export",
108+
"Properties": {
109+
"JAVA_HOME": "/usr/lib/jvm/java-1.8.0"
110+
}
111+
}
112+
],
113+
"Properties": {}
114+
}
115+
]
116+
EOF
117+
118+
service_role = "${aws_iam_role.iam_emr_service_role.arn}"
119+
}

‎linter/testdata/rules/dms_endpoint_encryption.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
2+
version: 1
3+
description: AWS DMS Endpoint Encryption
4+
type: Terraform
5+
files:
6+
- "*.tf"
7+
rules:
8+
9+
- id: AWS_DMS_ENDPOINT_ENCRYPTION
10+
message: AWS DMS Endpoint should have a kms key present
11+
resource: aws_dms_endpoint
12+
severity: WARNING
13+
assertions:
14+
- key: kms_key_arn
15+
op: present

‎linter/testdata/rules/emr_cluster_logs.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
version: 1
2+
description: AWS EMR Cluster Logging
3+
type: Terraform
4+
files:
5+
- "*.tf"
6+
rules:
7+
8+
- id: AWS_EMR_CLUSTER_LOGGING
9+
message: AWS EMR Should have logging enabled
10+
resource: aws_emr_cluster
11+
severity: WARNING
12+
assertions:
13+
- key: log_uri
14+
op: present
15+
tags:
16+
- emr

0 commit comments

Comments
 (0)