Sebastien Andrivet 22b1c621ad
Modify rule S6330: Default Queue encryption is now SSE-SQS (APPSEC-339) (#2626)
* Default Queue encryption is now SSE-SQS

* FIx typo
2024-09-02 12:03:57 +02:00

83 lines
1.8 KiB
Plaintext

include::../description.adoc[]
include::../ask-yourself.adoc[]
include::../recommended.adoc[]
== Sensitive Code Example
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sqs.Queue.html[`aws-cdk-lib.aws-sqs.Queue`]
[source,javascript]
----
import { Queue } from 'aws-cdk-lib/aws-sqs';
new Queue(this, 'example', {
encryption: QueueEncryption.UNENCRYPTED // Sensitive
});
----
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sqs.CfnQueue.html[`aws-cdk-lib.aws-sqs.CfnQueue`]
[source,javascript]
----
import { CfnQueue } from 'aws-cdk-lib/aws-sqs';
new CfnQueue(this, 'example', {
sqsManagedSseEnabled: false // Sensitive
});
----
== Compliant Solution
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sqs.Queue.html[`aws-cdk-lib.aws-sqs.Queue`]
[source,javascript]
----
import { Queue } from 'aws-cdk-lib/aws-sqs';
new Queue(this, 'example', {
encryption: QueueEncryption.SQS_MANAGED
});
----
For https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_sqs.CfnQueue.html[`aws-cdk-lib.aws-sqs.CfnQueue`]
[source,javascript]
----
import { CfnQueue } from 'aws-cdk-lib/aws-sqs';
new CfnQueue(this, 'example', {
sqsManagedSseEnabled: true
});
----
include::../see.adoc[]
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
=== Message
For Queue:
* Setting "encryption" to "QueueEncryption.UNENCRYPTED" disables SQS queues encryption. Make sure it is safe here.
For CfnQueue:
* Setting "sqsManagedSseEnabled" to "false" disables SQS queues encryption. Make sure it is safe here.
=== Highlighting
For Queue:
* Highlight the `encryption` attribute if it is set to `QueueEncryption.UNENCRYPTED`.
For CfnQueue:
* Highlight the `sqsManagedSseEnabled` attribute if it is set to `false`.
endif::env-github,rspecator-view[]