EFS Without KMS
- Query id: bdecd6db-2600-47dd-a10c-72c97cf17ae9
- Query name: EFS Without KMS
- Platform: Crossplane
- Severity: High
- Category: Encryption
- URL: Github
Description¶
Amazon Elastic Filesystem should have filesystem encryption enabled using KMS CMK customer-managed keys instead of AWS managed-keys
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
apiVersion: efs.aws.crossplane.io/v1alpha1
kind: FileSystem
metadata:
name: example3
spec:
forProvider:
region: us-east-1
encrypted: false
providerConfigRef:
name: example
---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: cluster-aws
labels:
provider: aws
cluster: eks
spec:
compositeTypeRef:
apiVersion: mydev.org/v1alpha1
kind: CompositeCluster
writeConnectionSecretsToNamespace: crossplane-system
patchSets:
- name: metadata
patches:
- fromFieldPath: metadata.labels
resources:
- name: sample-ec2
base:
apiVersion: efs.aws.crossplane.io/v1alpha1
kind: FileSystem
metadata:
name: example4
spec:
forProvider:
region: us-east-1
encrypted: false
providerConfigRef:
name: example
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
apiVersion: efs.aws.crossplane.io/v1alpha1
kind: FileSystem
metadata:
name: example
spec:
forProvider:
region: us-east-1
kmsKeyID: 1234abcd-12ab-34cd-56ef-1234567890ab
encrypted: true
providerConfigRef:
name: example
---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: cluster-aws
labels:
provider: aws
cluster: eks
spec:
compositeTypeRef:
apiVersion: mydev.org/v1alpha1
kind: CompositeCluster
writeConnectionSecretsToNamespace: crossplane-system
patchSets:
- name: metadata
patches:
- fromFieldPath: metadata.labels
resources:
- name: sample-ec2
base:
apiVersion: efs.aws.crossplane.io/v1alpha1
kind: FileSystem
metadata:
name: example2
spec:
forProvider:
region: us-east-1
kmsKeyID: 1234abcd-12ab-34cd-56ef-1234567890ab
encrypted: true
providerConfigRef:
name: example