cloud-report
Version:
Collects and analyzes cloud resources
45 lines (44 loc) • 2.52 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class RedshiftCMKEncryptionAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const allClusters = params.cluster_with_key_manager;
if (!allClusters) {
return undefined;
}
const cmk_encryption_redshift_clusters = { type: types_1.CheckAnalysisType.Security };
cmk_encryption_redshift_clusters.what = "Is encryption enabled for RedShift clusters using KMS CMK?";
cmk_encryption_redshift_clusters.why = "Data at rest should always be encrypted";
cmk_encryption_redshift_clusters.recommendation = "Recommended to enable encryption for Redshift Clusters";
cmk_encryption_redshift_clusters.benchmark = ['all', 'hipaa'];
const allRegionsAnalysis = {};
for (const region in allClusters) {
const regionClusters = allClusters[region];
allRegionsAnalysis[region] = [];
for (const clusterIdentifier of regionClusters) {
const cluster_encryption_analysis = {};
const cluster = clusterIdentifier;
cluster_encryption_analysis.resource = cluster;
cluster_encryption_analysis.resourceSummary = {
name: "Cluster", value: cluster.ClusterIdentifier
};
if (cluster.Encrypted && cluster.KmsKeyWithDescription.KeyMetadata &&
(cluster.KmsKeyWithDescription.KeyMetadata.KeyManager !== 'AWS')) {
cluster_encryption_analysis.severity = types_1.SeverityStatus.Good;
cluster_encryption_analysis.message = "Encryption enabled";
}
else {
cluster_encryption_analysis.severity = types_1.SeverityStatus.Failure;
cluster_encryption_analysis.message = "Encryption not enabled using KMS CMK for Redshift cluster";
cluster_encryption_analysis.action = "Enable encryption at rest for Redshift cluster using KMS CMK";
}
allRegionsAnalysis[region].push(cluster_encryption_analysis);
}
}
cmk_encryption_redshift_clusters.regions = allRegionsAnalysis;
return { cmk_encryption_redshift_clusters };
}
}
exports.RedshiftCMKEncryptionAnalyzer = RedshiftCMKEncryptionAnalyzer;