Description

Detects AWS EBS volumes defined in Terraform that are not configured with encryption enabled. Unencrypted EBS volumes pose a security risk since they store data in plaintext, potentially exposing sensitive information if the volume is compromised or improperly accessed.

Detection Strategy

• Identifies Terraform resource blocks that create AWS EBS volumes (aws_ebs_volume)

• Checks if the 'encrypted' property is either missing or explicitly set to false

• Reports a vulnerability when an EBS volume resource is found without proper encryption configuration

Vulnerable code example

resource "aws_ebs_volume" "example" {  # Vulnerable: EBS volume created without encryption
  availability_zone = "us-west-2a"
  size = 40
  
  tags = {
    Name = "HelloWorld"
  }
}

✅ Secure code example

resource "aws_ebs_volume" "example" {
  availability_zone = "us-west-2a"
  size             = 40
  encrypted        = true  # Enable encryption at rest for data security
  
  tags = {
    Name = "HelloWorld"
  }...