False positive: AWS.RDS.DataSecurity.High.0414 / AC_AWS_0058

[jrobison-sb]

• terrascan version:

$ terrascan version
version: v1.13.0

• Operating System:
  OSX

Description

AWS.RDS.DataSecurity.High.0414 / AC_AWS_0058 triggers a false positive when storage_encrypted = true and kms_key_id = null.

What I Did

resource "aws_db_instance" "example" {
  # minimum required attributes
  allocated_storage   = 20
  engine              = "postgres"
  instance_class      = "db.t3.micro"
  skip_final_snapshot = true
  password            = "REDACTED"
  username            = "postgres"

  # enable encryption
  storage_encrypted = true
}

$ aws rds describe-db-instances --db-instance-identifier terraform-20220202160946474400000001 | grep 'StorageEncrypted\|KmsKeyId'

            "StorageEncrypted": true,
            "KmsKeyId": "arn:aws:kms:us-east-1:1234567890:key/abcdefgh",

$ terrascan scan -i terraform -f ../../modules/aws/application/aws_db_instance_with_encryption.tf --scan-rules AWS.RDS.DataSecurity.High.0414
2022-02-02T11:18:32.879-0500	warn	filters/filter-specs.go:75	Deprecation warning : Use 'id' (AC_AWS_0058) instead of 'reference_id' (AWS.RDS.DataSecurity.High.0414) to skip/scan rules


Violation Details -
    
	Description    :	Ensure that your RDS database instances encrypt the underlying storage. Encrypted RDS instances use the industry standard AES-256 encryption algorithm to encrypt data on the server that hosts RDS DB instances. After data is encrypted, RDS handles authentication of access and descryption of data transparently with minimal impact on performance.
	File           :	aws_db_instance_with_encryption.tf
	Module Name    :	root
	Line           :	1
	Severity       :	HIGH