Add MSK rules

internal/app/cfsec/adapter/aws/adapt.go

@@ -21,6 +21,7 @@ import (
 	"github.com/aquasecurity/cfsec/internal/app/cfsec/adapter/aws/elasticsearch"
 	"github.com/aquasecurity/cfsec/internal/app/cfsec/adapter/aws/elb"
 	"github.com/aquasecurity/cfsec/internal/app/cfsec/adapter/aws/iam"
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/adapter/aws/msk"
 	"github.com/aquasecurity/cfsec/internal/app/cfsec/adapter/aws/neptune"
 	"github.com/aquasecurity/cfsec/internal/app/cfsec/adapter/aws/rds"
 	"github.com/aquasecurity/cfsec/internal/app/cfsec/adapter/aws/redshift"
@@ -56,6 +57,7 @@ func Adapt(cfFile parser.FileContext) aws.AWS {
 		ElastiCache:   elasticache.Adapt(cfFile),
 		Elasticsearch: elasticsearch.Adapt(cfFile),
 		ELB:           elb.Adapt(cfFile),
+		MSK:           msk.Adapt(cfFile),
 		Neptune:       neptune.Adapt(cfFile),
 		RDS:           rds.Adapt(cfFile),
 		Redshift:      redshift.Adapt(cfFile),

internal/app/cfsec/adapter/aws/msk/msk.go

@@ -0,0 +1,66 @@
+package msk
+
+import (
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/parser"
+	"github.com/aquasecurity/defsec/provider/aws/msk"
+	"github.com/aquasecurity/defsec/types"
+)
+
+func Adapt(cfFile parser.FileContext) msk.MSK {
+	return msk.MSK{
+		Clusters: getClusters(cfFile),
+	}
+}
+
+func getClusters(ctx parser.FileContext) (clusters []msk.Cluster) {
+	for _, clusterResource := range ctx.GetResourceByType("AWS::MSK::Cluster") {
+
+		var cluster msk.Cluster
+
+		if brokerProp := clusterResource.GetProperty("EncryptionInfo.EncryptionInTransit.ClientBroker"); brokerProp.IsString() {
+			cluster.EncryptionInTransit.ClientBroker = brokerProp.AsStringValue()
+		} else {
+			cluster.EncryptionInTransit.ClientBroker = types.StringDefault("TLS", clusterResource.Metadata())
+		}
+
+		if logsProp := clusterResource.GetProperty("LoggingInfo.BrokerLogs"); logsProp.IsNotNil() {
+			if cloudwatchProp := logsProp.GetProperty("CloudWatchLogs"); cloudwatchProp.IsNotNil() {
+				if enableProp := cloudwatchProp.GetProperty("Enabled"); enableProp.IsBool() {
+					cluster.Logging.Broker.Cloudwatch.Enabled = enableProp.AsBoolValue()
+				} else {
+					cluster.Logging.Broker.Cloudwatch.Enabled = types.BoolDefault(false, cloudwatchProp.Metadata())
+				}
+			} else {
+				cluster.Logging.Broker.Cloudwatch.Enabled = types.BoolDefault(false, logsProp.Metadata())
+			}
+
+			if firehoseProp := logsProp.GetProperty("Firehose"); firehoseProp.IsNotNil() {
+				if enableProp := firehoseProp.GetProperty("Enabled"); enableProp.IsBool() {
+					cluster.Logging.Broker.Firehose.Enabled = enableProp.AsBoolValue()
+				} else {
+					cluster.Logging.Broker.Firehose.Enabled = types.BoolDefault(false, firehoseProp.Metadata())
+				}
+			} else {
+				cluster.Logging.Broker.Firehose.Enabled = types.BoolDefault(false, logsProp.Metadata())
+			}
+
+			if s3Prop := logsProp.GetProperty("S3"); s3Prop.IsNotNil() {
+				if enableProp := s3Prop.GetProperty("Enabled"); enableProp.IsBool() {
+					cluster.Logging.Broker.S3.Enabled = enableProp.AsBoolValue()
+				} else {
+					cluster.Logging.Broker.S3.Enabled = types.BoolDefault(false, s3Prop.Metadata())
+				}
+			} else {
+				cluster.Logging.Broker.S3.Enabled = types.BoolDefault(false, logsProp.Metadata())
+			}
+
+		} else {
+			cluster.Logging.Broker.Cloudwatch.Enabled = types.BoolDefault(false, clusterResource.Metadata())
+			cluster.Logging.Broker.Firehose.Enabled = types.BoolDefault(false, clusterResource.Metadata())
+			cluster.Logging.Broker.S3.Enabled = types.BoolDefault(false, clusterResource.Metadata())
+		}
+
+		clusters = append(clusters, cluster)
+	}
+	return clusters
+}

internal/app/cfsec/rules/aws/msk/enable_in_transit_encryption_rule.go

@@ -0,0 +1,42 @@
+package rds
+
+import (
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/rule"
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/scanner"
+	"github.com/aquasecurity/defsec/rules/aws/msk"
+)
+
+func init() {
+	scanner.RegisterCheckRule(rule.Rule{
+
+		BadExample: []string{
+			`---
+AWSTemplateFormatVersion: 2010-09-09
+Description: Bad example
+Resources:
+  Cluster:
+    Type: AWS::MSK::Cluster
+    Properties:
+      EncryptionInfo:
+        EncryptionInTransit:
+          ClientBroker: "TLS_PLAINTEXT"
+
+`,
+		},
+
+		GoodExample: []string{
+			`---
+AWSTemplateFormatVersion: 2010-09-09
+Description: Good example
+Resources:
+  Cluster:
+    Type: AWS::MSK::Cluster
+    Properties:
+      EncryptionInfo:
+        EncryptionInTransit:
+          ClientBroker: "TLS"
+`,
+		},
+		Base: msk.CheckEnableInTransitEncryption,
+	})
+}

internal/app/cfsec/rules/aws/msk/enable_in_transit_encryption_rule_test.go

@@ -0,0 +1,17 @@
+package rds
+
+import (
+	"testing"
+
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/test"
+)
+
+func Test_MSK_InTransit_FailureExamples(t *testing.T) {
+	expectedCode := "aws-msk-enable-in-transit-encryption"
+	test.RunFailureExamplesTest(t, expectedCode)
+}
+
+func Test_MSK_InTransit_SuccessExamples(t *testing.T) {
+	expectedCode := "aws-msk-enable-in-transit-encryption"
+	test.RunPassingExamplesTest(t, expectedCode)
+}

internal/app/cfsec/rules/aws/msk/enable_logging_rule.go

@@ -0,0 +1,46 @@
+package rds
+
+import (
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/rule"
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/scanner"
+	"github.com/aquasecurity/defsec/rules/aws/msk"
+)
+
+func init() {
+	scanner.RegisterCheckRule(rule.Rule{
+
+		BadExample: []string{
+			`---
+AWSTemplateFormatVersion: 2010-09-09
+Description: Bad example
+Resources:
+  Cluster:
+    Type: AWS::MSK::Cluster
+    Properties:
+      LoggingInfo:
+        BrokerLogs:
+          CloudWatchLogs:
+            Enabled: false
+
+`,
+		},
+
+		GoodExample: []string{
+			`---
+AWSTemplateFormatVersion: 2010-09-09
+Description: Good example
+Resources:
+  Cluster:
+    Type: AWS::MSK::Cluster
+    Properties:
+      LoggingInfo:
+        BrokerLogs:
+          S3:
+            Enabled: true
+
+
+`,
+		},
+		Base: msk.CheckEnableLogging,
+	})
+}

internal/app/cfsec/rules/aws/msk/enable_logging_rule_test.go

@@ -0,0 +1,17 @@
+package rds
+
+import (
+	"testing"
+
+	"github.com/aquasecurity/cfsec/internal/app/cfsec/test"
+)
+
+func Test_MSK_Logs_FailureExamples(t *testing.T) {
+	expectedCode := "aws-msk-enable-logging"
+	test.RunFailureExamplesTest(t, expectedCode)
+}
+
+func Test_MSK_Logs_SuccessExamples(t *testing.T) {
+	expectedCode := "aws-msk-enable-logging"
+	test.RunPassingExamplesTest(t, expectedCode)
+}

vendor/modules.txt

@@ -110,6 +110,7 @@ github.com/aquasecurity/defsec/rules/aws/elasticache
 github.com/aquasecurity/defsec/rules/aws/elasticsearch
 github.com/aquasecurity/defsec/rules/aws/elb
 github.com/aquasecurity/defsec/rules/aws/iam
+github.com/aquasecurity/defsec/rules/aws/msk
 github.com/aquasecurity/defsec/rules/aws/neptune
 github.com/aquasecurity/defsec/rules/aws/rds
 github.com/aquasecurity/defsec/rules/aws/redshift