Memcached Disabled rule is not appropriate when you runs an ElasticCache Redis Cluster

[aminvielledebatAtBedrock]

Following the documentation here, elasticache engine can be redis or memcached.

Therefore, there is no reason to keep the rule 4bd15dd9-8d5e-4008-8532-27eb0c3706d3 | Medium activated.

Can you remove this rule, or give us any information to fix it ?

Expected Behavior

No warning in kics scans.

Actual Behavior

Terraform example :

resource "aws_elasticache_cluster" "my_test_cluster" {
  cluster_id           = "my_cluster_id"
  engine               = "redis"
  node_type            = "cache.t4.small"
  num_cache_nodes      = 1
  parameter_group_name = "default.redis5.0"
  engine_version       = "5.0.0"
  port                 = 6379
}

Kics logs :

Memcached Disabled, Severity: MEDIUM, Results: 1
Description: Check if the Memcached is disabled on the ElastiCache
Platform: Terraform

	[1]: ../../path/.cloud/terraform/test.tf:3

		002:   cluster_id           = "my_cluster_id"
		003:   engine               = "redis"
		004:   node_type            = "cache.t4.small"

Steps to Reproduce the Problem

Run kicks on your terraform test file with the following command :

docker run --rm -it -v /home/aminvielle/projects/kics:/bedrock-kics -v /home/aminvielle/projects/my-project:/path checkmarx/kics:v1.6.0 scan -p /path/.cloud/terraform --config /bedrock-kics/kics-config.yaml --queries-path ./assets/queries --queries-path /bedrock-kics/assets/queries/terraform/aws -o /path -v

[aminvielledebatAtBedrock]

duplicate of #3909

[rafaela-soares]

Hello @aminvielledebatAtBedrock

Thank you so much for bringing up this thread again. We will contact our AppSec team to take a look. As soon as we get a decision, we will let you know 😊

[rafaela-soares]

Meanwhile, you can use the flag --exclude-queries to exclude this query.

[rafaela-soares]

Hello again, @aminvielledebatAtBedrock

We changed the query approach in PR #5952. The query was implementing the wrong approach, maybe because of a misunderstanding during the development and review of it.

ElastiCache should have Redis enabled, since it covers Compliance Certifications such as FedRAMP, HIPAA, and PCI DSS. For more information, take a look at 'https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/SelectEngine.html'

Since Memcached it’s not compliant with PCI DSS, the query will now look for engine defined as 'memcached'