False positive: CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest"

[ismailyenigul]

Describe the bug

checkov fails on encryption enabled bucket

To Reproduce
Steps to reproduce the behavior:

check: CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
	FAILED for resource: aws_s3_bucket.my
	Guide: https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest
	File: /my/golden/s3.tf:1-18

		1  | resource "aws_s3_bucket" "my" {
		2  |   bucket = "my-${lower(var.environment)}-my-${lower(var.my)}"
		3  |   acl    = "private"
		4  |   # Delete S3 Bucket even it has some objects in it
		5  |   force_destroy = "true"
		6  | 
		7  |   server_side_encryption_configuration {
		8  |     rule {
		9  |       apply_server_side_encryption_by_default { sse_algorithm = "AES256" }
		10 |     }
		11 |   }
		12 | 
		13 |   versioning {
		14 |     enabled = false
		15 |   }
		16 | 
		17 | 
		18 | }

 
Version:

checkov -v
1.0.447

[nimrodkor]

Hi @ismailyenigul !

I think the problem is not a bad check. When scanning this block:

resource "aws_s3_bucket" "my" {
  bucket = "my-${lower(var.environment)}-my-${lower(var.my)}"
  acl    = "private"
  # Delete S3 Bucket even it has some objects in it
  force_destroy = "true"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default { 
        sse_algorithm = "AES256" 
      }
    }
  }

  versioning {
    enabled = false
  }
}

The difference is that the sse_algorithm is in it's own line - and the result is "PASSED" for me.
We know of this issue and plan to handle it soon. Thanks for reporting!

[ismailyenigul]

Cool thanks @nimrodkor

[ismailyenigul]

Another check about image pull policy.
I think this check should failed if the latest tag is used.
If we are not using latest tag, it should not be an issue no?

Check: CKV_K8S_15: "Image Pull Policy should be Always"
	FAILED for resource: Deployment.calico-typha-horizontal-autoscaler.kube-system (container 0)
	Guide: https://docs.bridgecrew.io/docs/bc_k8s_14
	File: /calico/staging/calico/calico.yaml:686-699

		686 |         - image: k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.7.1
		687 |           name: autoscaler
		688 |           command:
		689 |             - /cluster-proportional-autoscaler
		690 |             - --namespace=kube-system
		691 |             - --configmap=calico-typha-horizontal-autoscaler
		692 |             - --target=deployment/calico-typha
		693 |             - --logtostderr=true
		694 |             - --v=2
		695 |           resources:

[schosterbarak]

solved on #477