SONARPY-1416: Modify S6330: Default Queue encryption is now SSE-SQS (#…

…1546)
SonarSource · Aug 21, 2023 · eeaa409 · eeaa409
1 parent 49ef15b
commit eeaa409
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 30 deletions.
diff --git a/python-checks/src/main/java/org/sonar/python/checks/cdk/UnencryptedSqsQueueCheck.java b/python-checks/src/main/java/org/sonar/python/checks/cdk/UnencryptedSqsQueueCheck.java
@@ -23,38 +23,22 @@
 import org.sonar.plugins.python.api.SubscriptionContext;
 import org.sonar.plugins.python.api.tree.CallExpression;
 
-import static org.sonar.python.checks.cdk.CdkPredicate.isFqn;
+import static org.sonar.python.checks.cdk.CdkPredicate.isFalse;
 import static org.sonar.python.checks.cdk.CdkPredicate.isNone;
 import static org.sonar.python.checks.cdk.CdkUtils.getArgument;
 
 @Rule(key = "S6330")
 public class UnencryptedSqsQueueCheck extends AbstractCdkResourceCheck {
-  private static final String UNENCRYPTED_MESSAGE = "Setting \"encryption\" to \"QueueEncryption.UNENCRYPTED\" disables SQS queues encryption. Make sure it is safe here.";
-  private static final String NONE_MESSAGE = "Setting \"encryption\" to \"None\" disables SQS queues encryption. Make sure it is safe here.";
-  private static final String OMITTING_MESSAGE = "Omitting \"encryption\" disables SQS queues encryption. Make sure it is safe here.";
+  private static final String SQS_MANAGED_DISABLED_MESSAGE = "Setting \"sqs_managed_sse_enabled\" to \"false\" disables SQS queues encryption. Make sure it is safe here.";
   private static final String CFN_NONE_MESSAGE = "Setting \"kms_master_key_id\" to \"None\" disables SQS queues encryption. Make sure it is safe here.";
-  private static final String CFN_OMITTING_MESSAGE = "Omitting \"kms_master_key_id\" disables SQS queues encryption. Make sure it is safe here.";
 
   @Override
   protected void registerFqnConsumer() {
-    checkFqn("aws_cdk.aws_sqs.Queue", this::checkQueue);
     checkFqn("aws_cdk.aws_sqs.CfnQueue", this::checkCfnQueue);
   }
 
-  protected void checkQueue(SubscriptionContext ctx, CallExpression resourceConstructor) {
-    getArgument(ctx, resourceConstructor, "encryption").ifPresentOrElse(
-      flow -> {
-        flow.addIssueIf(isFqn("aws_cdk.aws_sqs.QueueEncryption.UNENCRYPTED"), UNENCRYPTED_MESSAGE);
-        flow.addIssueIf(isNone(), NONE_MESSAGE);
-      },
-      () -> ctx.addIssue(resourceConstructor.callee(), OMITTING_MESSAGE)
-    );
-  }
-
   protected void checkCfnQueue(SubscriptionContext ctx, CallExpression resourceConstructor) {
-    getArgument(ctx, resourceConstructor, "kms_master_key_id").ifPresentOrElse(
-      flow -> flow.addIssueIf(isNone(), CFN_NONE_MESSAGE),
-      () -> ctx.addIssue(resourceConstructor.callee(), CFN_OMITTING_MESSAGE)
-    );
+    getArgument(ctx, resourceConstructor, "sqs_managed_sse_enabled")
+        .ifPresent(flow -> flow.addIssueIf(isFalse(), SQS_MANAGED_DISABLED_MESSAGE));
   }
 }
diff --git a/python-checks/src/test/resources/checks/cdk/unencryptedSqsQueueCheck.py b/python-checks/src/test/resources/checks/cdk/unencryptedSqsQueueCheck.py
@@ -2,22 +2,30 @@
 
 # Success
 customKey = my_key.key_id
+enabled_sqs = True
 sqs.CfnQueue(self, "encrypted-selfmanaged", kms_master_key_id=my_key.key_id)
 sqs.CfnQueue(self, "encrypted-selfmanaged", kms_master_key_id=customKey)
+sqs.CfnQueue(self, "encrypted", sqs_managed_sse_enabled=True)
+sqs.CfnQueue(self, "encrypted", sqs_managed_sse_enabled=enabled_sqs)
 
+sqs.CfnQueue(self, "unencrypted")  # Compliant ref: SONARPY-1416
+
+noneKey = None
+sqs.CfnQueue(self, "encrypted-selfmanaged", kms_master_key_id=None)  # Compliant ref: SONARPY-1416
+sqs.CfnQueue(self, "encrypted-selfmanaged", kms_master_key_id=noneKey)  # Compliant ref: SONARPY-1416
+
 encryptionParam = sqs.QueueEncryption.KMS
 sqs.Queue(self, "encrypted-managed", encryption=sqs.QueueEncryption.KMS_MANAGED)
 sqs.Queue(self, "encrypted-managed", encryption=sqs.QueueEncryption.KMS)
 sqs.Queue(self, "encrypted-managed", encryption=encryptionParam)
 
-# Failing cases
-noneKey = None
-sqs.CfnQueue(self, "unencrypted") # NonCompliant{{Omitting "kms_master_key_id" disables SQS queues encryption. Make sure it is safe here.}}
-sqs.CfnQueue(self, "encrypted-selfmanaged", kms_master_key_id=None) # NonCompliant{{Setting "kms_master_key_id" to "None" disables SQS queues encryption. Make sure it is safe here.}}
-sqs.CfnQueue(self, "encrypted-selfmanaged", kms_master_key_id=noneKey) # NonCompliant{{Setting "kms_master_key_id" to "None" disables SQS queues encryption. Make sure it is safe here.}}
-
 encryptionNone = None
-sqs.Queue(self, "unencrypted-explicit") # NonCompliant {{Omitting "encryption" disables SQS queues encryption. Make sure it is safe here.}}
-sqs.Queue(self, "unencrypted-explicit", encryption=sqs.QueueEncryption.UNENCRYPTED) # NonCompliant {{Setting "encryption" to "QueueEncryption.UNENCRYPTED" disables SQS queues encryption. Make sure it is safe here.}}
-sqs.Queue(self, "unencrypted-explicit", encryption=None) # NonCompliant {{Setting "encryption" to "None" disables SQS queues encryption. Make sure it is safe here.}}
-sqs.Queue(self, "unencrypted-explicit", encryption=encryptionNone) # NonCompliant {{Setting "encryption" to "None" disables SQS queues encryption. Make sure it is safe here.}}
+sqs.Queue(self, "unencrypted-explicit")  # Compliant ref: SONARPY-1416
+sqs.Queue(self, "unencrypted-explicit", encryption=sqs.QueueEncryption.UNENCRYPTED) # Compliant ref: SONARPY-1416
+sqs.Queue(self, "unencrypted-explicit", encryption=None) # Compliant ref: SONARPY-1416  
+sqs.Queue(self, "unencrypted-explicit", encryption=encryptionNone) # Compliant ref: SONARPY-1416
+
+# Failing cases
+not_enabled_sqs = False
+sqs.CfnQueue(self, "unencrypted", sqs_managed_sse_enabled=False) # NonCompliant{{Setting "sqs_managed_sse_enabled" to "false" disables SQS queues encryption. Make sure it is safe here.}}
+sqs.CfnQueue(self, "unencrypted", sqs_managed_sse_enabled=not_enabled_sqs) # NonCompliant{{Setting "sqs_managed_sse_enabled" to "false" disables SQS queues encryption. Make sure it is safe here.}}