id: unencrypted-aws-ami
info:
  name: Unencrypted AWS AMI
  author: princechaddha
  severity: high
  description: |
    Ensure Amazon Machine Images (AMIs) are encrypted to meet data-at-rest encryption compliance and protect sensitive data.
  impact: |
    Unencrypted AMIs can expose sensitive data to unauthorized access, risking data breaches and non-compliance with data protection regulations.
  remediation: |
    Encrypt your AMIs using AWS managed keys or customer-managed keys in the AWS Key Management Service (KMS) to ensure data security.
  reference:
    - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIEncryption.html
  tags: cloud,devops,aws,amazon,ec2,aws-cloud-config

variables:
  region: "us-east-1"

flow: |
  code(1)
  for(let AmiName of iterate(template.amis)){
    set("ami", AmiName)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      aws ec2 describe-images --region $region --owners self --output json --query 'Images[*].ImageId'

    extractors:
      - type: json
        name: amis
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
         aws ec2 describe-images --region $region --image-ids $ami --query 'Images[*].BlockDeviceMappings[*].Ebs.Encrypted[]'

    matchers:
      - type: word
        words:
          - "false"

    extractors:
      - type: dsl
        dsl:
          - 'ami + " AMI is not encrypted"'
# digest: 4a0a00473045022100a7b00e475c508994eab83d044d65086d511d0dcdde83abed644133c35775d4a402203ff217b94895c174e5d6036a27c3cedba4e74cc0b2a4fb957b71390c2d7454eb:922c64590222798bb761d5b6d8e72950