org.sonar.l10n.javascript.rules.javascript.S6303.html Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of javascript-checks Show documentation
There is a newer version: 10.17.0.28100
Using unencrypted RDS DB resources exposes data to unauthorized access.
 This includes database data, logs, automatic backups, read replicas,
snapshots, and cluster metadata.
This situation can occur in a variety of scenarios, such as:

   A malicious insider working at the cloud provider gains physical access to the storage device. 
   Unknown attackers penetrate the cloud provider’s logical infrastructure and systems. 

After a successful intrusion, the underlying applications are exposed to:

   theft of intellectual property and/or personal data 
   extortion 
   denial of services and security bypasses via data corruption or deletion 

AWS-managed encryption at rest reduces this risk with a simple switch.
Ask Yourself Whether

   The database contains sensitive data that could cause harm when leaked. 
   There are compliance requirements for the service to store data encrypted. 

There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
It is recommended to enable encryption at rest on any RDS DB resource, regardless of the engine.
 In any case, no further maintenance is
required as encryption at rest is fully managed by AWS.
Sensitive Code Example
For aws-cdk-lib.aws_rds.CfnDBCluster:
import { aws_rds as rds } from 'aws-cdk-lib';

new rds.CfnDBCluster(this, 'example', {
  storageEncrypted: false, // Sensitive
});

For aws-cdk-lib.aws_rds.CfnDBInstance:
import { aws_rds as rds } from 'aws-cdk-lib';

new rds.CfnDBInstance(this, 'example', {
  storageEncrypted: false, // Sensitive
});

For aws-cdk-lib.aws_rds.DatabaseCluster:
import { aws_rds as rds } from 'aws-cdk-lib';
import { aws_ec2 as ec2 } from 'aws-cdk-lib';

declare const vpc: ec2.Vpc;

const cluster = new rds.DatabaseCluster(this, 'example', {
  engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_2_08_1 }),
  instanceProps: {
    vpcSubnets: {
      subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
    },
    vpc,
  },
  storageEncrypted: false, // Sensitive
});

For aws-cdk-lib.aws_rds.DatabaseClusterFromSnapshot:
import { aws_rds as rds } from 'aws-cdk-lib';

declare const vpc: ec2.Vpc;

new rds.DatabaseClusterFromSnapshot(this, 'example', {
  engine: rds.DatabaseClusterEngine.aurora({ version: rds.AuroraEngineVersion.VER_1_22_2 }),
  instanceProps: {
    vpc,
  },
  snapshotIdentifier: 'exampleSnapshot',
  storageEncrypted: false, // Sensitive
});

For aws-cdk-lib.aws_rds.DatabaseInstance:
import { aws_rds as rds } from 'aws-cdk-lib';

declare const vpc: ec2.Vpc;

new rds.DatabaseInstance(this, 'example', {
  engine: rds.DatabaseInstanceEngine.POSTGRES,
  vpc,
  storageEncrypted: false, // Sensitive
});

For aws-cdk-lib.aws_rds.DatabaseInstanceReadReplica:
import { aws_rds as rds } from 'aws-cdk-lib';

declare const sourceInstance: rds.DatabaseInstance;

new rds.DatabaseInstanceReadReplica(this, 'example', {
  sourceDatabaseInstance: sourceInstance,
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.LARGE),
  vpc,
  storageEncrypted: false, // Sensitive
});

Compliant Solution
For aws-cdk-lib.aws_rds.CfnDBCluster:
import { aws_rds as rds } from 'aws-cdk-lib';

new rds.CfnDBCluster(this, 'example', {
  storageEncrypted: true,
});

For aws-cdk-lib.aws_rds.CfnDBInstance:
import { aws_rds as rds } from 'aws-cdk-lib';

new rds.CfnDBInstance(this, 'example', {
  storageEncrypted: true,
});

For aws-cdk-lib.aws_rds.DatabaseCluster:
import { aws_rds as rds } from 'aws-cdk-lib';

declare const vpc: ec2.Vpc;

const cluster = new rds.DatabaseCluster(this, 'example', {
  engine: rds.DatabaseClusterEngine.auroraMysql({ version: rds.AuroraMysqlEngineVersion.VER_2_08_1 }),
  instanceProps: {
    vpcSubnets: {
      subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
    },
    vpc,
  },
  storageEncrypted: false, // Sensitive
});

For aws-cdk-lib.aws_rds.DatabaseClusterFromSnapshot:
import { aws_rds as rds } from 'aws-cdk-lib';

declare const vpc: ec2.Vpc;

new rds.DatabaseClusterFromSnapshot(this, 'example', {
  engine: rds.DatabaseClusterEngine.aurora({ version: rds.AuroraEngineVersion.VER_1_22_2 }),
  instanceProps: {
    vpc,
  },
  snapshotIdentifier: 'exampleSnapshot',
  storageEncrypted: true,
});

For aws-cdk-lib.aws_rds.DatabaseInstance:
import { aws_rds as rds } from 'aws-cdk-lib';

declare const vpc: ec2.Vpc;

new rds.DatabaseInstance(this, 'example', {
  engine: rds.DatabaseInstanceEngine.POSTGRES,
  vpc,
  storageEncrypted: true,
});

For aws-cdk-lib.aws_rds.DatabaseInstanceReadReplica:
import { aws_rds as rds } from 'aws-cdk-lib';

declare const sourceInstance: rds.DatabaseInstance;

new rds.DatabaseInstanceReadReplica(this, 'example', {
  sourceDatabaseInstance: sourceInstance,
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.LARGE),
  vpc,
  storageEncrypted: true,
});

See

   AWS Documentation - Encrypting Amazon RDS
  resources 
   CWE - CWE-311 - Missing Encryption of Sensitive Data 
   STIG Viewer - Application Security and
  Development: V-222588 - The application must implement approved cryptographic mechanisms to prevent unauthorized modification of information at
  rest.