#2810 - Add check if aws s3 bucket is encrypted.

[UranusBytes]

Fixes #2810 - Add check if aws s3 bucket is encrypted.

Required terraform aws provider >= 1.6

Signed-off-by: Jeremy Phillips github@uranusbytes.com

[clintoncwolfe]

Was Blocked by #2884, now unblocked

[TrevorBramble]

Hi, thanks for your contribution!

Please consider the following suggestions.

[TrevorBramble]

You can omit these curly braces and lose some of the noise here. OpenStruct.new(server_side_encryption_configuration: OpenStruct.new(rules: []))

[TrevorBramble]

Add a space before the 'private' argument, please. (Or wrap it with parentheses.)

[TrevorBramble]

I think putting these three cases into an actual case statement would make the purpose of this method more clear.

def get_bucket_encryption(query)
  buckets = {
    'public' => OpenStruct.new(server_side_encryption_configuration: OpenStruct.new(rules: []))
  }

  case
  when query[:bucket].eql? 'private'
    raise Aws::S3::Errors::ServerSideEncryptionConfigurationNotFoundError.new(nil, nil)
  when !buckets.key?(query[:bucket])
    raise Aws::S3::Errors::NoSuchBucket.new(nil, nil)
  else
    buckets[query[:bucket]]
  end
end

In writing that, I realized the second and third cases are actually just a missing use of fetch(), which I think is even better than the case approach.

def get_bucket_encryption(query)
  buckets = {
    'public' => OpenStruct.new(server_side_encryption_configuration: OpenStruct.new(rules: []))
  }

  if query[:bucket].eql? 'private'
    raise Aws::S3::Errors::ServerSideEncryptionConfigurationNotFoundError.new(nil, nil)
  end

  buckets.fetch(query[:bucket]) { raise Aws::S3::Errors::NoSuchBucket.new(nil, nil) }
end

[TrevorBramble]

A few things here. =^)

Line 100 is hard to read for how long it is. Going vertical with those method calls off BackendFactory would make it more readable.

We can do a single assignment to @has_default_encryption_enabled from whatever you return in the catch_aws_errors block.

def fetch_bucket_encryption_configuration
  @has_default_encryption_configuration ||= catch_aws_errors do
    begin
      !BackendFactory.create(inspec_runner)
        .get_bucket_encryption(bucket: bucket_name)
        .server_side_encryption_configuration
        .nil?
    rescue Aws::S3::Errors::ServerSideEncryptionConfigurationNotFoundError
      false
    end
  end
end

[TrevorBramble]

[nitpick] Extra spacing between sse_algorithm and =.

[TrevorBramble]

[nitpick] Predicate methods should only ever return explicit true or false values. So return false unless @exists would be the more accurate guard statement.

[jquick]

Hey @UranusBytes, we merged in the new terraform pins and you will need to rebase your branch. Sorry about that.

[TrevorBramble]

Thanks!

[jquick]

Thanks @UranusBytes