CKV_GCP_5 - BaseResourceValueCheck class implementation
-from checkov.common.models.enums import CheckResult, CheckCategories
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckCategories
+from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck
+from checkov.common.models.consts import ANY_VALUE
-class GoogleStorageBucketEncryption(BaseResourceCheck):
+class GoogleStorageBucketEncryption(BaseResourceValueCheck):
def __init__(self):
name = "Ensure Google storage bucket have encryption enabled"
id = "CKV_GCP_5"
@@ -10,20 +11,10 @@ class GoogleStorageBucketEncryption(BaseResourceCheck):
categories = [CheckCategories.ENCRYPTION]
super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
- def scan_resource_conf(self, conf):
- """
- Looks for password configuration at azure_instance:
- https://www.terraform.io/docs/providers/azure/r/instance.html
- :param conf: azure_instance configuration
- :return: <CheckResult>
- """
- if 'encryption' in conf.keys():
- if len(conf['encryption'])>0:
- encryption_conf = conf['encryption'][0]
- if 'default_kms_key_name' in encryption_conf.keys():
- if encryption_conf['default_kms_key_name']:
- return CheckResult.PASSED
- return CheckResult.FAILED
+ def get_inspected_key(self):
+ return 'encryption/[0]/default_kms_key_name'
+ def get_expected_values(self):
+ return [ANY_VALUE]
check = GoogleStorageBucketEncryption()
