github-actions[bot] ce9501054b
Create rule S6275 Using unencrypted EBS volumes is security-sensitive (#1286)
Co-authored-by: pedro-oliveira-sonarsource <pedro.oliveira@sonarsource.com>
2022-10-17 16:08:27 +02:00

65 lines
1.5 KiB
Plaintext

include::../description.adoc[]
include::../ask-yourself.adoc[]
include::../recommended.adoc[]
== Sensitive Code Example
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Volume.html[aws_cdk.aws_ec2.Volume]:
[source,javascript]
----
import { Size } from 'aws-cdk-lib';
import { Volume } from 'aws-cdk-lib/aws-ec2';
new Volume(this, 'unencrypted-explicit', {
availabilityZone: 'us-west-2a',
size: Size.gibibytes(1),
encrypted: false // Sensitive
});
----
[source,javascript]
----
import { Size } from 'aws-cdk-lib';
import { Volume } from 'aws-cdk-lib/aws-ec2';
new Volume(this, 'unencrypted-implicit', {
availabilityZone: 'eu-west-1a',
size: Size.gibibytes(1),
}); // Sensitive as encryption is disabled by default
----
== Compliant Solution
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Volume.html[aws_cdk.aws_ec2.Volume]:
[source,javascript]
----
import { Size } from 'aws-cdk-lib';
import { Volume } from 'aws-cdk-lib/aws-ec2';
new Volume(this, 'encrypted-explicit', {
availabilityZone: 'eu-west-1a',
size: Size.gibibytes(1),
encrypted: true
});
----
include::../see.adoc[]
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
=== Highlighting
* Highlight the `props` object if it does not contain the property `encrypted`.
* Highlight the `encrypted` property if it is not set to `true`.
endif::env-github,rspecator-view[]