added policy to check enable storage encryption for documentdb

avd_docs/aws/documentdb/AVD-AWS-0189/docs.md

@@ -0,0 +1,13 @@
+
+Ensure documentDB storage must be encrypted
+
+### Impact
+<!-- Add Impact here -->
+
+<!-- DO NOT CHANGE -->
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/documentdb/latest/developerguide/encryption-at-rest.html
+
+

internal/rules/policies/cloud/policies/aws/documentdb/enable_storage_encryption.rego

@@ -0,0 +1,25 @@
+# METADATA
+# title: "Documentdb Storage Encrypted"
+# description: "Ensure documentDB storage must be encrypted"
+# scope: package
+# schemas:
+# - input: schema.input
+# related_resources:
+# - https://docs.aws.amazon.com/documentdb/latest/developerguide/encryption-at-rest.html
+# custom:
+#   avd_id: AVD-AWS-0189
+#   provider: aws
+#   service: documentdb
+#   severity: HIGH
+#   short_code: enable-storage-encryption
+#   recommended_action: "Encryption of the underlying storage used by DocumentDB ensures that if their is compromise of the disks, the data is still protected."
+#   input:
+#     selector:
+#     - type: cloud
+package builtin.aws.documentdb.aws0189
+
+deny[res] {
+	cluster := input.aws.documentdb.clusters[_]
+	not cluster.storageencrypted.value
+	res := result.new("Cluster storage does not have encryption enabled.", cluster.storageencrypted)
+}

internal/rules/policies/cloud/policies/aws/documentdb/enable_storage_encryption_test.rego

@@ -0,0 +1,11 @@
+package builtin.aws.documentdb.aws0189
+
+test_detects_when_decrypted {
+	r := deny with input as {"aws": {"documentdb": {"clusters": [{"storageencrypted": {"value": false}}]}}}
+	count(r) == 1
+}
+
+test_when_encrypted {
+	r := deny with input as {"aws": {"documentdb": {"clusters": [{"storageencrypted": {"value": true}}]}}}
+	count(r) == 0
+}