#278 - Create rule for S3 Bucket Encryption

lib/cfn-nag/custom_rules/S3BucketEncryptionSetRule.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class S3BucketEncryptionSetRule < BaseRule
+  def rule_text
+    'S3 Bucket should have encryption option set'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W41'
+  end
+
+  def audit_impl(cfn_model)
+    violating_buckets = cfn_model.resources_by_type('AWS::S3::Bucket').select do |bucket|
+      bucket.bucketEncryption.nil?
+    end
+
+    violating_buckets.map(&:logical_resource_id)
+  end
+end

spec/custom_rules/S3BucketEncyptionSetRule_spec.rb

@@ -0,0 +1,16 @@
+require 'spec_helper'
+require 'cfn-model'
+require 'cfn-nag/custom_rules/S3BucketEncryptionSetRule'
+
+describe S3BucketEncryptionSetRule do
+  context 's3 bucket with encryption set' do
+    it 'returns offending logical resource id' do
+      cfn_model = CfnParser.new.parse read_test_template('json/s3_bucket/buckets_with_no_encryption.json')
+
+      actual_logical_resource_ids = S3BucketEncryptionSetRule.new.audit_impl cfn_model
+      expected_logical_resource_ids = %w[S3BucketEncryptionNotSet]
+
+      expect(actual_logical_resource_ids).to eq expected_logical_resource_ids
+    end
+  end
+end

spec/test_templates/json/s3_bucket/buckets_with_no_encryption.json

@@ -0,0 +1,28 @@
+{
+  "Resources": {
+    "S3BucketEncryptionNotSet" : {
+      "Type" : "AWS::S3::Bucket",
+      "Properties" : {
+        "BucketName" : "fakebucketfaaaake",
+        "AccessControl": "BucketOwnerRead"
+      }
+    },
+
+    "Green_S3BucketEncryptionSet" : {
+      "Type" : "AWS::S3::Bucket",
+      "Properties" : {
+        "BucketName" : "encryptedfakebucket",
+        "AccessControl": "BucketOwnerRead",
+        "BucketEncryption": {
+          "ServerSideEncryptionConfiguration": [
+            {
+              "ServerSideEncryptionByDefault": {
+                "SSEAlgorithm": "AES256"
+              }
+            }
+          ]
+        }    
+      }
+    }
+  }
+}