fix(query): fix EFS Volume With Disabled Transit Encryption queries for multiple volumes cases

[cx-artur-ribeiro]

Reason for Proposed Changes

• The EFS Volume With Disabled Transit Encryption Terraform query did not account for multiple volumes in a single aws_ecs_task_definition resource, causing all volumes to generate identical similarityIDs. Without volume indexing in the searchKey and searchLine, KICS silently deduplicated vulnerability reports, leaving security issues in additional volumes undetected.
• Terraform Query: Did not explicitly index volumes (resource.volume instead of resource.volume[vol_idx]), causing all volumes to generate identical searchKeys and searchLines;
• CloudFormation Query: Used a helper function that produced multiple outputs for the same inputs, triggering eval_conflict_error and preventing the query from executing;
• No test cases validated multiple volumes in a single resource, allowing the bug to go undetected;

Proposed Changes

• Terraform Query Refactoring
  • Added volume indexing: Changed from resource.volume to resource.volume[vol_idx] to capture array indices
  • Added structure detection: Implemented is_array() checks to handle both:
    • Single volume (object): "volume": {...};
    • Multiple volumes (array): "volume": [{...}, {...}];
  • Created helper functions:
    • get_volumes(): Normalizes both structures, returning volume objects with indices;
    • get_search_key(): Builds unique searchKeys including volume index when present;
    • get_search_line(): Inserts volume index into searchLine path for proper identification;
  • Each volume now generates a unique similarityID, ensuring all vulnerabilities are reported;
• CloudFormation Query Refactoring
  • Removed is_transit_encryption_disabled() that caused eval_conflict_error;
  • Flattened to 4 independent CxPolicy rules:
    1. TransitEncryption explicitly set to non-ENABLED value
    2. TransitEncryption attribute missing (with null check to prevent overlap)
    3. EFSVolumeConfiguration block missing
    4. Volumes property missing entirely
• Terraform Tests:
  • positive1-3.tf: Single volume scenarios (DISABLED, missing attribute, missing config);
  • positive4-6.tf: Multiple volume scenarios (2 volumes each with same issue type);
  • positive7.tf: Mixed scenario (one good volume, one bad volume);
  • negative1-2.tf: Properly configured resources (single and multiple volumes);
• CloudFormation Tests:
  • positive1-8: Single volume scenarios in both JSON and YAML;
  • positive9-11: Multiple volume scenarios in both JSON and YAML;
  • positive12: Mixed scenario in both JSON and YAML;
  • negative1-3: Properly configured resources in JSON and YAML;

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.18

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0

[cx-eduardo-semanas]

LGTM