remediation: AWS Glue Data Catalog CMK Encrypted remediated

plugins/aws/glue/dataCatalogCmkEncrypted.js

@@ -9,6 +9,26 @@ module.exports = {
     recommended_action: 'Modify Glue data catalog to use CMK instead of AWS-managed Key to encrypt Metadata',
     link: 'https://docs.aws.amazon.com/glue/latest/dg/encrypt-glue-data-catalog.html',
     apis: ['Glue:getDataCatalogEncryptionSettings', 'KMS:listKeys', 'KMS:describeKey'],
+    remediation_description: 'Glue data catalog Encryption for the affected regions will be enabled.',
+    remediation_min_version: '202114032330',
+    apis_remediate: ['Glue:getDataCatalogEncryptionSettings'],
+    remediation_inputs: {
+        kmsKeyArnforDataCatalog: {
+            name: '(Mandatory) KMS Key Arn',
+            description: 'The KMS Key Arn used for encryption',
+            regex: '^arn:(aws|aws-cn|aws-us-gov):(kms):.+',
+            required: true
+        }
+    },
+    actions: {
+        remediate: ['Glue:putDataCatalogEncryptionSettings'],
+        rollback: ['Glue:putDataCatalogEncryptionSettings']
+    },
+    permissions: {
+        remediate: ['glue:PutDataCatalogEncryptionSettings'],
+        rollback: ['glue:PutDataCatalogEncryptionSettings']
+    },
+    realtime_triggers: ['glue:PutDataCatalogEncryptionSettings'],
 
     run: function(cache, settings, callback) {
         var results = [];
@@ -39,8 +59,7 @@ module.exports = {
                 var describeKey = helpers.addSource(cache, source,
                     ['kms', 'describeKey', region, kmsKeyId]);
 
-                if (!describeKey || describeKey.err || !describeKey.data ||
-                    !describeKey.data.KeyMetadata || !describeKey.data.KeyMetadata) {
+                if (!describeKey || describeKey.err || !describeKey.data || !describeKey.data.KeyMetadata) {
                     helpers.addResult(results, 3,
                         `Unable to query KMS key: ${helpers.addError(describeKey)}`,
                         region, kmsKeyId);
@@ -66,5 +85,56 @@ module.exports = {
         }, function(){
             callback(null, results, source);
         });
+    },
+
+    remediate: function(config, cache, settings, resource, callback) {
+        var putCall = this.actions.remediate;
+        var pluginName = 'dataCatalogCmkEncrypted';
+
+        var region = settings.region;
+
+        config.region = region;
+        var params = {};
+
+        // create the params necessary for the remediation
+        if (settings.input &&
+            settings.input.kmsKeyIdforDataCatalog) {
+            params = {
+                DataCatalogEncryptionSettings: {
+                    EncryptionAtRest: {
+                        CatalogEncryptionMode: 'SSE-KMS',
+                        SseAwsKmsKeyId: settings.input.kmsKeyIdforDataCatalog
+                    }
+                }
+            };
+        } else {
+            return callback('KMS key arn is mandatory to CMK encrypt Glue data catalog');
+        }
+
+        var remediation_file = settings.remediation_file;
+
+        remediation_file['pre_remediate']['actions'][pluginName][region] = {
+            'DataCatalogCMKEncryption': 'Disabled',
+            'Glue': region
+        };
+
+        // passes the config, put call, and params to the remediate helper function
+        helpers.remediatePlugin(config, putCall[0], params, function(err) {
+            if (err) {
+                remediation_file['remediate']['actions'][pluginName]['error'] = err;
+                return callback(err, null);
+            }
+
+            let action = params;
+            action.action = putCall;
+
+            remediation_file['post_remediate']['actions'][pluginName][resource] = action;
+            remediation_file['remediate']['actions'][pluginName][resource] = {
+                'Action': 'DATA_CATALOG_CMK_ENCRYPTED',
+                'Glue': region
+            };
+            settings.remediation_file = remediation_file;
+            return callback(null, action);
+        });
     }
 };