feat: Support bucket encryption for existing cloudtrail

Signed-off-by: Lei Jin <lei.jin@lacework.net>
lacework · Sep 5, 2024 · 0116256 · 0116256
1 parent e5ecd21
commit 0116256
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/integration/aws_generation_test.go b/integration/aws_generation_test.go
@@ -159,6 +159,8 @@ func TestGenerationAwsNoninteractive(t *testing.T) {
 		aws.WithCloudtrailUseExistingTrail(true),
 		aws.WithCloudtrailName(cloudtrailName),
 		aws.WithExistingCloudtrailBucketArn(s3BucketArn),
+		aws.WithBucketEncryptionEnabled(true),
+		aws.WithBucketSSEKeyArn(kmsArn),
 		aws.WithCloudtrailUseExistingSNSTopic(true),
 		aws.WithExistingSnsTopicArn(snsTopicArn),
 		aws.WithSnsTopicEncryptionEnabled(true),

diff --git a/lwgenerate/aws/aws.go b/lwgenerate/aws/aws.go
@@ -1058,14 +1058,14 @@ func createCloudtrail(args *GenerateAwsTfConfigurationArgs) (*hclwrite.Block, er
 			if args.BucketName != "" {
 				attributes["bucket_name"] = args.BucketName
 			}
-			if args.BucketEncryptionEnabledSet {
-				if args.BucketEncryptionEnabled {
-					if args.BucketSseKeyArn != "" {
-						attributes["bucket_sse_key_arn"] = args.BucketSseKeyArn
-					}
-				} else {
-					attributes["bucket_encryption_enabled"] = false
+		}
+		if args.BucketEncryptionEnabledSet {
+			if args.BucketEncryptionEnabled {
+				if args.BucketSseKeyArn != "" {
+					attributes["bucket_sse_key_arn"] = args.BucketSseKeyArn
 				}
+			} else {
+				attributes["bucket_encryption_enabled"] = false
 			}
 		}
 		if args.S3BucketNotification {