accurics.GCP.EKM.132 and accurics.GCP.EKM.131 wrong violation using disk_encryption_key

[fredprod]

• terrascan version: v1.1.0
• Operating System: MacOS 10.15.7

Description

Terrascan wrongly reports a violation of accurics.GCP.EKM.132 and accurics.GCP.EKM.131
Wrong violation if we use disk_encryption_key in instance or disk.

In vmEncryptedwithCsek.rego, we have this in google_compute_disk regarding accurics.GCP.EKM.131

package accurics

vmEncryptedwithCsek[api.id]
{
     api := input.google_compute_disk[_]
     not api.config.disk_encryption_key == null
}

In encryptedwithCsek.rego, we have this in google_compute_instance regarding accurics.GCP.EKM.132

package accurics

encryptedwithCsek[api.id]
{
     api := input.google_compute_disk[_]
     not api.config.disk_encryption_key == null
}

What I Did

For both, I fixed replacing block in each .rego files like this:

{
     api := input.google_compute_disk[_]
     not api.config.disk_encryption_key
}
{
     api := input.google_compute_disk[_]
     api.config.disk_encryption_key == null
}

Don't know if it is the right way to fix that, but it fixed it on my side.

[harkirat22]

@fredprod . Thank you for raising the issue. Absolutely, your approach to solving this is on point. Therefore, we have made changes. Along with adding another block, I have improved the policy for compute instances, now the policy relates the compute disk which is not encrypted to the instances with which it is attached.