rspec/rules/S6303/terraform/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

For https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance[aws_db_instance]
and https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster[aws_rds_cluster]:

----
resource "aws_db_instance" "example" {
  storage_encrypted = false # Sensitive, disabled by default
}

resource "aws_rds_cluster" "example" {
  storage_encrypted = false # Sensitive, disabled by default
}
----

== Compliant Solution

For https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance[aws_db_instance]
and https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster[aws_rds_cluster]:

[source,terraform]
----
resource "aws_db_instance" "example" {
  storage_encrypted = true
}

resource "aws_rds_cluster" "example" {
  storage_encrypted = true
}
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

* Make sure that using unencrypted databases is safe here.
* Omitting "storage_encrypted" disables databases encryption. Make sure it is safe here.


endif::env-github,rspecator-view[]