feat(terraform): add CKV_AWS_375, CKV_AWS_376, CKV_AWS_377 to add three new SageMaker checks

[braidoa]

User description

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

I've added three checks for Amazon SageMaker attributes.

New/Edited policies (Delete if not relevant)

id = "CKV_AWS_375"
name = "Ensure Amazon SageMaker endpoint has a name specified"

• checks for the "name" attribute
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_model

id = "CKV_AWS_376"
name = "Ensure Amazon SageMaker endpoint configuration has at least one production variant specified"

• checks for at least 1 "production_variants" attribute
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_endpoint_configuration

id = "CKV_AWS_377"
name = "Ensure Amazon SageMaker notebook instances use lifecycle configurations"

• checks for the "lifecycle_config_name" attribute
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_notebook_instance

Description

Violations in each rule will occur when a SageMaker resource is missing the respective attribute.

Fix

Someone can fix these issues by specifying the attributes.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:

Introduce three new checks for Amazon SageMaker resources in Terraform to ensure compliance with best practices. The SagemakerEndpointConfigurationEndpointNameSpecified class checks that SageMaker endpoints have a specified name, while the SagemakerEndpointConfigurationProductionVariantsSpecified class ensures that endpoint configurations have at least one production variant. Additionally, the SagemakerNotebookLifecycleConfigSpecified class verifies that SageMaker notebook instances utilize lifecycle configurations. These checks are implemented in the checkov library and are accompanied by corresponding test cases to validate their functionality.

Topic	Details
Test Cases	Implement test cases to validate the new SageMaker checks for endpoint configurations and notebook instances. Modified files (3) tests/terraform/checks/resource/aws/example_SagemakerNotebookLifecycleConfigSpecified/main.tf tests/terraform/checks/resource/aws/example_SagemakerEndpointConfigurationNameSpecified/main.tf tests/terraform/checks/resource/aws/example_SagemakerEndpointConfigurationProductionVariantsSpecified/main.tf Latest Contributors(0) User Commit Date
SageMaker Checks	Add checks for SageMaker resources to ensure compliance with naming and configuration standards. Modified files (3) checkov/terraform/checks/resource/aws/SagemakerEndpointConfigurationProductionVariantsSpecified.py checkov/terraform/checks/resource/aws/SagemakerNotebookLifecycleConfigSpecified.py checkov/terraform/checks/resource/aws/SagemakerEndpointConfigurationNameSpecified.py Latest Contributors(0) User Commit Date

This pull request is reviewed by Baz. Join @braidoa and the rest of your team on (Baz).

[braidoa]

Hi folks. Is anyone available to review this?

[tsmithv11]

Thanks for the contribution, @braidoa! My concern about these checks is that Checkov is meant to be a security tool and these don't appear to be security checks. Am I misunderstanding?

[tsmithv11]

Requiring name isn't really a security check. You can also use name_prefix which would be valid but flagged by this check.

[braidoa]

See comment below. 😄

[tsmithv11]

Can you explain the security concern of Terraform assigning a random name?

[braidoa]

It's a GRC (specifically governance) concern. For example, my org requires specified SageMaker names and tags in spreadsheets, project management boards, planning docs, etc. A random, unspecific name could confuse users and result in downstream problems. So we prohibit random names in SageMaker endpoints for better governance.

[tsmithv11]

@braidoa we reviewed internally and the first 2 checks feel like ones you can use as custom for your organization. If you'd like to update the PR to just include the last one Ensure Amazon SageMaker notebook instances use lifecycle configurations, we'd gladly accept it.