Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CKV_GCP_5 Fails even if encryption is enabled

See original GitHub issue

Describe the bug Not sure how the check works but on the example from the link in the output shows

resource "google_storage_bucket" "auto-expire" {
  name          = "auto-expiring-bucket"
  location      = "US"
  force_destroy = true
+ encryption = default_kms_key_name

However, encryption is a struct and it should be

resource "google_storage_bucket" "auto-expire" {
  name          = "auto-expiring-bucket"
  location      = "US"
  force_destroy = true
+ encryption {
+    default_kms_key_name = <key name>
   }

Expected behavior When the encryption block is present the check should pass.

Output

Step #3 - "checkov": Check: CKV_GCP_29: "Ensure that Cloud Storage buckets have uniform bucket-level access enabled"
Step #3 - "checkov":    FAILED for resource: google_storage_bucket.tfplans
Step #3 - "checkov":    File: /storage__tfplans.tf:14-50
Step #3 - "checkov":    Guide: https://docs.bridgecrew.io/docs/bc_gcp_gcs_2
Step #3 - "checkov": 
Step #3 - "checkov":            14 | resource "google_storage_bucket" "tfplans" {
Step #3 - "checkov":            15 |   name = "company-tfplans"
Step #3 - "checkov":            16 |   storage_class = "STANDARD"
Step #3 - "checkov":            17 |   labels = merge(local.labels, {
Step #3 - "checkov":            18 |     service-name = "terraform"
Step #3 - "checkov":            19 |     service-visibility = "admin"
Step #3 - "checkov":            20 |   })
Step #3 - "checkov":            21 | 
Step #3 - "checkov":            22 |   encryption {
Step #3 - "checkov":            23 |     default_kms_key_name = local.kms__terraform-plans
Step #3 - "checkov":            24 |   }
Step #3 - "checkov":            25 |   logging {
Step #3 - "checkov":            26 |     log_bucket = "company-logs"
Step #3 - "checkov":            27 |     log_object_prefix = "storage/company-tfplan/"
Step #3 - "checkov":            28 |   }
Step #3 - "checkov":            29 |   versioning {
Step #3 - "checkov":            30 |     enabled = true
Step #3 - "checkov":            31 |   }
Step #3 - "checkov":            32 |   lifecycle_rule {
Step #3 - "checkov":            33 |     action {
Step #3 - "checkov":            34 |       type = "Delete"
Step #3 - "checkov":            35 |     }
Step #3 - "checkov":            36 |     condition {
Step #3 - "checkov":            37 |       num_newer_versions = 5
Step #3 - "checkov":            38 |     }
Step #3 - "checkov":            39 |   }
Step #3 - "checkov":            40 |   lifecycle_rule {
Step #3 - "checkov":            41 |     action {
Step #3 - "checkov":            42 |       type = "Delete"
Step #3 - "checkov":            43 |     }
Step #3 - "checkov":            44 |     condition {
Step #3 - "checkov":            45 |       age = 14
Step #3 - "checkov":            46 |     }
Step #3 - "checkov":            47 |   }
Step #3 - "checkov":            48 | 
Step #3 - "checkov":            49 | 
Step #3 - "checkov":            50 | }
Finished Step #3 - "checkov"

Desktop (please complete the following information):