adds rule for cloudwatch logs encryption

tenable · Oct 19, 2020 · 14fb90e · 14fb90e
1 parent a8fce5a
commit 14fb90e
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/...cies/opa/rego/aws/aws_cloudwatch/AWS.CloudWatch.EncryptionandKeyManagement.High.0632.json b/...cies/opa/rego/aws/aws_cloudwatch/AWS.CloudWatch.EncryptionandKeyManagement.High.0632.json
@@ -0,0 +1,10 @@
+{
+    "name": "logGroupNotEncryptedWithKms",
+    "file": "logGroupNotEncryptedWithKms.rego",
+    "template_args": null,
+    "severity": "HIGH",
+    "description": "AWS CloudWatch log group is not encrypted with a KMS CMK",
+    "reference_id": "AWS.CloudWatch.EncryptionandKeyManagement.High.0632",
+    "category": "Encryption and Key Management",
+    "version": 2
+}
diff --git a/pkg/policies/opa/rego/aws/aws_cloudwatch/logGroupNotEncryptedWithKms.rego b/pkg/policies/opa/rego/aws/aws_cloudwatch/logGroupNotEncryptedWithKms.rego
@@ -0,0 +1,6 @@
+package accurics
+
+logGroupNotEncryptedWithKms[log_group.id] {
+  log_group := input.aws_cloudwatch_log_group[_]
+  not log_group.config.kms_key_id
+}