feat(terraform): ensure kms key policy is defined

checkov/terraform/checks/graph_checks/aws/KmsKeyPolicyIsDefined.yaml

@@ -0,0 +1,23 @@
+metadata:
+  id: "CKV2_AWS_64"
+  name: "Ensure KMS key Policy is defined"
+  category: "IAM"
+definition:
+  or:
+    - cond_type: "attribute"
+      resource_types:
+        - "aws_kms_key"
+      attribute: "policy"
+      operator: "exists"
+    - and:
+      - cond_type: filter
+        attribute: resource_type
+        operator: within
+        value:
+          - aws_kms_key
+      - cond_type: connection
+        resource_types:
+          - aws_kms_key
+        connected_resource_types:
+          - aws_kms_key_policy
+        operator: exists

tests/terraform/graph/checks/resources/KmsKeyPolicyIsDefined/expected.yaml

@@ -0,0 +1,5 @@
+pass:
+  - "aws_kms_key.pass"
+  - "aws_kms_key.pass2"
+fail:
+  - "aws_kms_key.fail"

tests/terraform/graph/checks/resources/KmsKeyPolicyIsDefined/main.tf

@@ -0,0 +1,48 @@
+resource "aws_kms_key" "pass" {
+    enable_key_rotation = true
+}
+
+resource "aws_kms_key" "pass2" {
+  enable_key_rotation = true
+  policy = jsonencode({
+    Id = "example"
+    Statement = [
+      {
+        Action = "kms:*"
+        Effect = "Allow"
+        Principal = {
+          AWS = "*"
+        }
+
+        Resource = "*"
+        Sid      = "Enable IAM User Permissions"
+      },
+    ]
+    Version = "2012-10-17"
+  })
+}
+
+resource "aws_kms_key_policy" "pike" {
+  key_id = aws_kms_key.pass.id
+  policy = jsonencode({
+    Id = "example"
+    Statement = [
+      {
+        Action = "kms:*"
+        Effect = "Allow"
+        Principal = {
+          AWS = "*"
+        }
+
+        Resource = "*"
+        Sid      = "Enable IAM User Permissions"
+      },
+    ]
+    Version = "2012-10-17"
+  })
+}
+
+resource "aws_kms_key" "fail" {
+  enable_key_rotation = true
+}
+

tests/terraform/graph/checks/resources/VPCHasRestrictedSG/main.tf

@@ -47,3 +47,5 @@ resource "aws_security_group_rule" "default_sg_rule" {
   type              = "-1"
   security_group_id = aws_default_security_group.default_3.id
 }
+
+resource "aws_s3_bucket" "ignore" {}

tests/terraform/graph/checks/test_yaml_policies.py

@@ -22,6 +22,9 @@ def setUp(self) -> None:
         warnings.filterwarnings("ignore", category=ResourceWarning)
         warnings.filterwarnings("ignore", category=DeprecationWarning)
 
+    def test_KmsKeyPolicyIsDefined(self):
+        self.go("KmsKeyPolicyIsDefined")
+
     def test_NetworkFirewallHasLogging(self):
         self.go("NetworkFirewallHasLogging")