feat(service): Added default encryption kms connection

Author: m-pizarro

README.md

@@ -133,7 +133,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
 | iot                         |                                                                                                                                                                                                                                                                                                                                                                               |
 | kinesisFirehose             | kinesisStream, s3, iamRole                                                                                                                                                                                                                                                                                                                                                    |
 | kinesisStream               | kinesisFirehose                                                                                                                                                                                                                                                                                                                                                               |
-| kms                         | cloudtrail, cloudwatchLog, codebuild, ecsCluster, efs, eksCluster, elastiCacheReplicationGroup, elasticSearchDomain, emrCluster, managedAirflow, lambda, rdsCluster, rdsClusterSnapshot, rdsDbInstance, sns, sageMakerNotebookInstance, secretsManager, dmsReplicationInstance, redshiftCluster                                                                               |
+| kms                         | cloudtrail, cloudwatchLog, codebuild, ecsCluster, efs, eksCluster, elastiCacheReplicationGroup, elasticSearchDomain, emrCluster, managedAirflow, lambda, rdsCluster, rdsClusterSnapshot, rdsDbInstance, sns, sageMakerNotebookInstance, secretsManager, dmsReplicationInstance, redshiftCluster, s3                                                                               |
 | lambda                      | appSync, cognitoUserPool, kms, s3, secretsManager, securityGroup, subnet, vpc, iamRole                                                                                                                                                                                                                                                                                        |
 | managedAirflow              | cloudwatchLog, iamRole, kms, securityGroups, subnet, s3                                                                                                                                                                                                                                                                                                                       |
 | nacl                        | vpc                                                                                                                                                                                                                                                                                                                                                                           |
@@ -150,7 +150,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
 | sageMakerExperiment         |                                                                                                                                                                                                                                                                                                                                                                               |
 | sageMakerNotebookInstance   | iamRole, kms, networkInterface, subnet, securityGroup                                                                                                                                                                                                                                                                                                                         |
 | sageMakerProject            |                                                                                                                                                                                                                                                                                                                                                                               |
-| s3                          | cloudfront, cloudtrail, ecsCluster, iamRole, kinesisFirehose, lambda, managedAirflow, sns, sqs                                                                                                                                                                                                                                                                                |
+| s3                          | cloudfront, cloudtrail, ecsCluster, iamRole, kinesisFirehose, kms, lambda, managedAirflow, sns, sqs                                                                                                                                                                                                                                                                                |
 | secretsManager              | kms, lambda                                                                                                                                                                                                                                                                                                                                                                   |
 | securityGroup               | alb, asg, clientVpnEndpoint, codebuild, dmsReplicationInstance, ecsService, lambda, ec2, elasticSearchDomain, elb, rdsCluster, rdsDbInstance, eksCluster, elastiCacheCluster, managedAirflow, sageMakerNotebookInstance, networkInterface                                                                                                                                     |
 | ses                         |                                                                                                                                                                                                                                                                                                                                                                               |

src/services/kms/schema.graphql

@@ -51,4 +51,5 @@ type awsKms implements awsBaseService @key(fields: "id") {
   rdsCluster: [awsRdsCluster] @hasInverse(field: kms)
   rdsDbInstance: [awsRdsDbInstance] @hasInverse(field: kms)
   managedAirflows: [awsManagedAirflow] @hasInverse(field: kms)
+  s3: [awsS3] @hasInverse(field: kms)
 }

src/services/s3/connections.ts

@@ -32,6 +32,7 @@ export default ({
         TopicConfigurations: topicConfigurations,
         QueueConfigurations: queueConfigurations,
       },
+      EncryptionInfo: encryptionInfo,
     },
   } = service
 
@@ -144,6 +145,31 @@ export default ({
     }
   }
 
+  /**
+   * Find KMS
+   * related to the S3
+   */
+  const kmsKeyIds = encryptionInfo?.Rules?.map(
+    r => r.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID
+  )
+  const kmsKeys = data.find(({ name }) => name === services.kms)
+  if (kmsKeys?.data?.[region] && kmsKeyIds?.length > 0) {
+    const kmsKeyInRegion = kmsKeys.data[region].filter(kmsKey =>
+      kmsKeyIds.includes(kmsKey.Arn)
+    )
+
+    if (!isEmpty(kmsKeyInRegion)) {
+      for (const kms of kmsKeyInRegion) {
+        connections.push({
+          id: kms.KeyId,
+          resourceType: services.kms,
+          relation: 'child',
+          field: 'kms',
+        })
+      }
+    }
+  }
+
   const s3Result = {
     [id]: connections,
   }

src/services/s3/schema.graphql

@@ -110,4 +110,5 @@ type awsS3 implements awsBaseService @key(fields: "arn") {
   sns: [awsSns] @hasInverse(field: s3)
   sqs: [awsSqs] @hasInverse(field: s3)
   ecsCluster: [awsEcsCluster] @hasInverse(field: s3)
+  kms: [awsKms] @hasInverse(field: s3)
 }

src/types/generated.ts

@@ -3323,6 +3323,7 @@ export type AwsKms = AwsBaseService & {
   rdsClusterSnapshots?: Maybe<Array<Maybe<AwsRdsClusterSnapshot>>>;
   rdsDbInstance?: Maybe<Array<Maybe<AwsRdsDbInstance>>>;
   redshiftCluster?: Maybe<Array<Maybe<AwsRedshiftCluster>>>;
+  s3?: Maybe<Array<Maybe<AwsS3>>>;
   sageMakerNotebookInstances?: Maybe<Array<Maybe<AwsSageMakerNotebookInstance>>>;
   secretsManager?: Maybe<Array<Maybe<AwsSecretsManager>>>;
   sns?: Maybe<Array<Maybe<AwsSns>>>;
@@ -3840,6 +3841,7 @@ export type AwsS3 = AwsBaseService & {
   iamRole?: Maybe<Array<Maybe<AwsIamRole>>>;
   ignorePublicAcls?: Maybe<Scalars['String']>;
   kinesisFirehose?: Maybe<Array<Maybe<AwsKinesisFirehose>>>;
+  kms?: Maybe<Array<Maybe<AwsKms>>>;
   lambdas?: Maybe<Array<Maybe<AwsLambda>>>;
   lifecycle?: Maybe<Scalars['String']>;
   logging?: Maybe<Scalars['String']>;