Module AWS.KMS.Logging.High.0400 seems to serve no purpose

[matt-slalom]

• terrascan version: 1.8.0

Description

I noticed that in scans of code that include KMS keys that the module AWS.KMS.Logging.High.0400 triggers. The description for this module reads, "Ensure rotation for customer created CMKs is enabled," but it points to kmsKeyNoDeletionWindow.rego which actually checks for the key deletion window (not rotation).

This looks like a copy/paste error since this same description is in AWS.AKK.DP.HIGH.0012.

Looking at it more closely, AWS.KMS.Logging.High.0400 seems to serve no purpose in AWS since keys cannot set deletion_window_in_days until they are scheduled for deletion. Similarly, deletion_window_in_days cannot be set higher than 30, and AWS sets a default value is none is explicitly set.

That makes me think this entire module can be deleted. Unless perhaps it's trying to check for something I'm not understanding? Either way, the module seems to be broken. I'm happy to assist in fixing it, but right now its purpose is unclear.

I plan to submit a PR that deletes this module, unless someone can tell me it's actually needed.

[matt-slalom]

Submitted PR #918