feat(sources): add encryption-at-rest data source#2442
Draft
Conversation
auto-merge was automatically disabled
February 5, 2026 12:02
Pull request was converted to draft
mrgrain
force-pushed
the
mrgrain/feat/encryption-at-rest-poc
branch
6 times, most recently
from
694e8cd to
f79993a
Compare
mrgrain
force-pushed
the
mrgrain/feat/encryption-at-rest-poc
branch
2 times, most recently
from
4ccb462 to
f25084b
Compare
mrgrain
force-pushed
the
mrgrain/feat/encryption-at-rest-poc
branch
from
f25084b to
98d57b9
Compare
Contributor
|
@aws-cdk/aws-service-spec: No model change detected |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new data source documenting encryption-at-rest configuration for AWS CloudFormation resources.
Encryption configuration in CloudFormation is inconsistent across services. Some use boolean flags, others use nested configuration objects, and property names vary widely (
KmsKeyId,KmsKeyArn,EncryptionKey, etc.). This makes it difficult to programmatically apply or validate encryption settings.This data source provides a normalized view of encryption properties across 130+ resources. Each entry classifies properties by their purpose (
enable-flag,kms-key-id,encryption-type, orconfiguration), documents the default behavior, and captures important constraints like immutability.With this structured data, tooling can understand how to enable encryption for any resource without hardcoding service-specific knowledge.
This is an initial implementation. The dataset can be expanded following the patterns documented in AGENT_STEERING.md.