Proposed fix for check for Redshift Cluster Logging
ADD
checkov/terraform/checks/resource/aws/RedshiftClusterLogging.py
+from checkov.common.models.enums import CheckResult, CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+
+
+class RedshiftClusterLogging(BaseResourceValueCheck):
+ def __init__(self):
+ name = "Ensure Redshift Cluster logging is enabled"
+ id = "CKV_AWS_71"
+ supported_resource = ['aws_redshift_cluster']
+ categories = [CheckCategories.LOGGING]
+ super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource)
+
+ def get_inspected_key(self):
+ return 'logging/[0]/enable'
+
+check = RedshiftClusterLogging()

ADD
tests/terraform/checks/resource/aws/test_RedshiftClusterLogging.py
+import unittest
+
+import hcl2
+
+from checkov.terraform.checks.resource.aws.RedshiftClusterLogging import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestRedshiftClusterLogging(unittest.TestCase):
+
+ def test_failure_missing_1(self):
+ hcl_res = hcl2.loads("""
+ resource "aws_redshift_cluster" "default" {
+ cluster_identifier = "tf-redshift-cluster"
+ database_name = "mydb"
+ master_username = "foo"
+ master_password = "Mustbe8characters"
+ node_type = "dc1.large"
+ cluster_type = "single-node"
+ }
+ """)
+ resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default']
+ scan_result = check.scan_resource_conf(conf=resource_conf)
+ self.assertEqual(CheckResult.FAILED, scan_result)
+
+ def test_failure_missing_2(self):
+ hcl_res = hcl2.loads("""
+ resource "aws_redshift_cluster" "default" {
+ cluster_identifier = "tf-redshift-cluster"
+ database_name = "mydb"
+ master_username = "foo"
+ master_password = "Mustbe8characters"
+ node_type = "dc1.large"
+ cluster_type = "single-node"
+ logging {
+ somethingelse = "true"
+ }
+ }
+ """)
+ resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default']
+ scan_result = check.scan_resource_conf(conf=resource_conf)
+ self.assertEqual(CheckResult.FAILED, scan_result)
+
+
+ def test_failure_false(self):
+ hcl_res = hcl2.loads("""
+ resource "aws_redshift_cluster" "default" {
+ cluster_identifier = "tf-redshift-cluster"
+ database_name = "mydb"
+ master_username = "foo"
+ master_password = "Mustbe8characters"
+ node_type = "dc1.large"
+ cluster_type = "single-node"
+ logging {
+ enable = 0
+ }
+ }
+ """)
+ resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default']
+ scan_result = check.scan_resource_conf(conf=resource_conf)
+ self.assertEqual(CheckResult.FAILED, scan_result)
+
+ def test_success(self):
+ hcl_res = hcl2.loads("""
+ resource "aws_redshift_cluster" "default" {
+ cluster_identifier = "tf-redshift-cluster"
+ database_name = "mydb"
+ master_username = "foo"
+ master_password = "Mustbe8characters"
+ node_type = "dc1.large"
+ cluster_type = "single-node"
+ logging {
+ enable = 1
+ }
+ }
+ """)
+ resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default']
+ scan_result = check.scan_resource_conf(conf=resource_conf)
+ self.assertEqual(CheckResult.PASSED, scan_result)
+
+if __name__ == '__main__':
+ unittest.main()

Proposed fix for #173 check for Redshift Cluster Logging (#514)