EFS Volume With Disabled Transit Encryption

• Query id: 4d46ff3b-7160-41d1-a310-71d6d370b08f
• Query name: EFS Volume With Disabled Transit Encryption
• Platform: Terraform
• Severity: Medium
• Category: Encryption
• CWE: 319
• Risk score: 7.1
• URL: Github

Description

AWS ECS Task Definition EFS data in transit between AWS ECS host and AWS EFS server should be encrypted
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "aws_ecs_task_definition" "service" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "service-storage"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs.id
      root_directory          = "/opt/data"
      transit_encryption      = "DISABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test.id
        iam             = "ENABLED"
      }
    }
  }
}

Positive test num. 2 - tf file

resource "aws_ecs_task_definition" "service_2" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "service-storage"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs.id
      root_directory          = "/opt/data"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test.id
        iam             = "ENABLED"
      }
    }
  }
}

Positive test num. 3 - tf file

resource "aws_ecs_task_definition" "service_2" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "service-storage"
  }
}

Positive test num. 4 - tf file

resource "aws_ecs_task_definition" "service_4" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "service-storage-1"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs1.id
      root_directory          = "/opt/data1"
      transit_encryption      = "DISABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test1.id
        iam             = "ENABLED"
      }
    }
  }

  volume {
    name = "service-storage-2"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs2.id
      root_directory          = "/opt/data2"
      transit_encryption      = "DISABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test2.id
        iam             = "ENABLED"
      }
    }
  }
}

Positive test num. 5 - tf file

resource "aws_ecs_task_definition" "service_5" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "service-storage-1"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs1.id
      root_directory          = "/opt/data1"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test1.id
        iam             = "ENABLED"
      }
    }
  }

  volume {
    name = "service-storage-2"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs2.id
      root_directory          = "/opt/data2"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test2.id
        iam             = "ENABLED"
      }
    }
  }
}

Positive test num. 6 - tf file

resource "aws_ecs_task_definition" "service_6" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "docker-storage-1"
  }

  volume {
    name = "docker-storage-2"
  }
}

Positive test num. 7 - tf file

resource "aws_ecs_task_definition" "service_7" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "efs-vol-good"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs1.id
      root_directory          = "/opt/data1"
      transit_encryption      = "ENABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test1.id
        iam             = "ENABLED"
      }
    }
  }

  volume {
    name = "efs-vol-bad"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs2.id
      root_directory          = "/opt/data2"
      transit_encryption      = "DISABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test2.id
        iam             = "ENABLED"
      }
    }
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "aws_ecs_task_definition" "service" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "service-storage"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs.id
      root_directory          = "/opt/data"
      transit_encryption      = "ENABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test.id
        iam             = "ENABLED"
      }
    }
  }
}

Negative test num. 2 - tf file

resource "aws_ecs_task_definition" "service" {
  family                = "service"
  container_definitions = file("task-definitions/service.json")

  volume {
    name = "efs-vol-1"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs1.id
      root_directory          = "/opt/data1"
      transit_encryption      = "ENABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test1.id
        iam             = "ENABLED"
      }
    }
  }

  volume {
    name = "efs-vol-2"

    efs_volume_configuration {
      file_system_id          = aws_efs_file_system.fs2.id
      root_directory          = "/opt/data2"
      transit_encryption      = "ENABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = aws_efs_access_point.test2.id
        iam             = "ENABLED"
      }
    }
  }
}