All six EBS volumes backing the etcd nodes in deployment/terraform/modules/k8s-cluster/aws/asg/main.tf are explicitly set to encrypted = false:
| Resource |
File |
Line context |
aws_ebs_volume.1-etcd-events, 1-etcd-main |
asg/main.tf |
encrypted = false |
aws_ebs_volume.2-etcd-events, 2-etcd-main |
asg/main.tf |
encrypted = false |
aws_ebs_volume.3-etcd-events, 3-etcd-main |
asg/main.tf |
encrypted = false |
Since these hold etcd's data (cluster state and secrets for the k8s cluster this provisions), unencrypted-at-rest seemed worth flagging even without knowing anything else about how this module gets deployed. Flipping the flag to true shouldn't need anything else changed.
Found this with InfraScan (https://github.com/SolDevelo/InfraScan), an open-source cost/security scanner covering Terraform, Kubernetes, Helm, CloudFormation, Ansible, and containers (Apache-2.0). If it's useful, it's a few lines to add as a GitHub Action (https://github.com/marketplace/actions/infrascan-iac-cost-security-scanner).
All six EBS volumes backing the etcd nodes in
deployment/terraform/modules/k8s-cluster/aws/asg/main.tfare explicitly set toencrypted = false:aws_ebs_volume.1-etcd-events,1-etcd-mainencrypted = falseaws_ebs_volume.2-etcd-events,2-etcd-mainencrypted = falseaws_ebs_volume.3-etcd-events,3-etcd-mainencrypted = falseSince these hold etcd's data (cluster state and secrets for the k8s cluster this provisions), unencrypted-at-rest seemed worth flagging even without knowing anything else about how this module gets deployed. Flipping the flag to
trueshouldn't need anything else changed.Found this with InfraScan (https://github.com/SolDevelo/InfraScan), an open-source cost/security scanner covering Terraform, Kubernetes, Helm, CloudFormation, Ansible, and containers (Apache-2.0). If it's useful, it's a few lines to add as a GitHub Action (https://github.com/marketplace/actions/infrascan-iac-cost-security-scanner).