Rule claims omitting "kms_master_key_id" disables SQS queue encryption which is outdated

Rules and Languages Report False-positive / False-negative...
1

Note that if the SqsManagedSseEnabled: true property is not specified, SSE-SQS is enabled by default.

Even when explicitly enabling SSE-SQS with sqs_managed_sse_enabled = true it will bring up this alert.

  • Are you using
    • SonarQube - which version? 9.9
  • How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)
resource "aws_sqs_queue" "terraform_queue" {
  name                    = "terraform-example-queue"
  sqs_managed_sse_enabled = true
}
7

Hi Udo and welcome to the community!

Thanks for reporting this issue. We are already tracking it internally and will try to resolve it soon.

9

Hi Hendrik,
This issue is replicating in our templates too. Do we have work around for this?

10

Hi @Basha_Shaik ,

what SonarQube version are you using? It seems this was already fixed a year ago.

11

I’m encountering the same issue in one of our projects.

We’re using the sonarqube:9.9.6-community docker image for the server and the sonarsource/sonar-scanner-cli:5.0.0 docker image for the scanner.

I noticed that in version 10, the “How can I fix it?” section for the rule has been updated. For example, in this rule, the description now mentions the sqs_managed_sse_enabled parameter. However, in the 9.9.6 image, it still references the kms_master_key_id option.

12

Hey @cponce

That’s it then – the issue was fixed for Terraform in v10.6 of SonarQube, and v10.2 for Python. You’ll need to upgrade SonarQube to benefit from the fix.

13

Thanks for your reply, Colin.

Is there any plan to backport the fix to the LTA release?

14

There is not. If the rule is just too noisy for now, you can remove it from your QP, or mark the issues as FPs.