added policy to check encryption for cloudtrail

avd_docs/aws/cloudtrail/AVD-AWS-0187/docs.md

@@ -0,0 +1,13 @@
+
+Ensures CloudTrail encryption at rest is enabled for logs
+
+### Impact
+<!-- Add Impact here -->
+
+<!-- DO NOT CHANGE -->
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
+
+

avd_docs/kubernetes/general/AVD-KSV-01010/docs.md

@@ -2,7 +2,7 @@
 Storing sensitive content such as usernames and email addresses in configMaps is unsafe
 
 ### Impact
-Unsafe storage of sensitive content in configMaps could lead to the information being compromised.
+<!-- Add Impact here -->
 
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}

avd_docs/kubernetes/general/AVD-KSV-0107/docs.md

@@ -1,10 +1,13 @@
 
-apiVersion and kind has been deprecated
+apiVersion '' and kind '' has been deprecated on: '' and planned for removal on:''
 
 ### Impact
 <!-- Add Impact here -->
 
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}
 
+### Links
+- 
+
 

avd_docs/kubernetes/general/AVD-KSV-0108/docs.md

@@ -2,8 +2,8 @@
 Services with external IP addresses allows direct access from the internet and might expose risk for CVE-2020-8554
 
 ### Impact
-Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
-https://www.cvedetails.com/cve/CVE-2020-8554/
+<!-- Add Impact here -->
+
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}
 

avd_docs/kubernetes/general/AVD-KSV-0109/docs.md

@@ -2,7 +2,7 @@
 Storing secrets in configMaps is unsafe
 
 ### Impact
-Unsafe storage of secret content in configMaps could lead to the information being compromised.
+<!-- Add Impact here -->
 
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}

internal/rules/policies/cloud/policies/aws/cloudtrail/enable_at_rest_encryption.rego

@@ -0,0 +1,25 @@
+# METADATA
+# title: "CloudTrail Encryption"
+# description: "Ensures CloudTrail encryption at rest is enabled for logs"
+# scope: package
+# schemas:
+# - input: schema.input
+# related_resources:
+# - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
+# custom:
+#   avd_id: AVD-AWS-0187
+#   provider: aws
+#   service: cloudtrail
+#   severity: HIGH
+#   short_code: enable-at-rest-encryption
+#   recommended_action: "Enable CloudTrail log encryption through the CloudTrail console or API"
+#   input:
+#     selector:
+#     - type: cloud
+package builtin.aws.cloudtrail.aws0187
+
+deny[res] {
+	trail := input.aws.cloudtrail.trails[_]
+	trail.kmskeyid.value == ""
+	res := result.new("Trail is not encrypted.",trail.kmskeyid)
+}

internal/rules/policies/cloud/policies/aws/cloudtrail/enable_at_rest_encryption_test.rego

@@ -0,0 +1,11 @@
+package builtin.aws.cloudtrail.aws0187
+
+test_detects_when_decrypted {
+	r := deny with input as {"aws": {"cloudtrail": {"trails": [{"kmskeyid": {"value": ""}}]}}}
+	count(r) == 1
+}
+
+test_when_encrypted {
+	r := deny with input as {"aws": {"cloudtrail": {"trails": [{"kmskeyid": {"value": "key12"}}]}}}
+	count(r) == 0
+}