Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

branch[accurics_unxkse6c]: Auto Generated Pull Request from Accurics #25

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

branch[accurics_unxkse6c]: Auto Generated Pull Request from Accurics #25

Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e7167d1
Auto Remediation by Accurics, file: main.tf, resource: aws_instance.w…
tenablecs-dev Sep 14, 2021
726bebc
Auto Remediation by Accurics, file: main.tf, resource: aws_instance.w…
tenablecs-dev Sep 14, 2021
470ed28
Auto Remediation by Accurics, file: main.tf, resource: aws_instance.w…
tenablecs-dev Sep 14, 2021
5a0b867
Auto Remediation by Accurics, file: main.tf, resource: aws_s3_bucket.…
tenablecs-dev Sep 14, 2021
e44f437
Auto Remediation by Accurics, file: main.tf, resource: aws_s3_bucket.…
tenablecs-dev Sep 14, 2021
3eae656
Auto Remediation by Accurics, file: main.tf, resource: aws_s3_bucket.…
tenablecs-dev Sep 14, 2021
2585c5f
Auto Remediation by Accurics, file: main.tf, resource: aws_s3_bucket.…
tenablecs-dev Sep 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,12 @@ resource "aws_instance" "webserver" {
tags = {
Name = "webserver"
}

metadata_options {
http_endpoint = "disabled"
http_tokens = "required"
}
monitoring = true
}

resource "aws_s3_bucket" "accuricsbucketdemo" {
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Accurics remediation

[HIGH]: Ensure at-rest server side encryption (SSE) is enabled for AWS S3 Buckets

Vulnerability
AWS S3 Buckets do not have at-rest server side encryption enabled to protect sensitive data.

Remediation
On the AWS S3 console, for each bucket that failed the rule, navigate to the Properties tab, and select Default encryption. Select an encryption method (AES-256 or AWS-KMS).

source: accurics-stageone

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Accurics remediation

[HIGH]: Ensure versioning is enabled for AWS S3 Buckets

Vulnerability
Enabling S3 versioning will enable easy recovery from both unintended user actions, like deletes and overwrites.

Remediation
You can use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. With versioning, you can easily recover from both unintended user actions and application failures. When you enable versioning for a bucket, if Amazon S3 receives multiple write requests for the same object simultaneously, it stores all of the objects.

source: accurics-stageone

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Accurics remediation

[MEDIUM]: Ensure access logging is enabled for AWS S3 Buckets

Vulnerability
AWS S3 Buckets have access logging disabled. Access log information can be useful in security and access audits.

Remediation
By default, Amazon S3 doesn't collect server access logs. When you enable logging, Amazon S3 delivers access logs for a source bucket to a target bucket that you choose. The target bucket must be in the same AWS Region as the source bucket and must not have a default retention period configuration.

source: accurics-stageone

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Accurics remediation

[HIGH]: Ensure AWS S3 Buckets are accessible to all authenticated users

Vulnerability
S3 bucket Access is allowed to all AWS Account Users.

Remediation
Amazon S3 Bucket ACL with full control permission to authenticated users allows anyone with an AWS account to access objects in the bucket. When read and write access is granted to authenticated users, they can read, edit and delete the objects in the bucket. It is a recommended practice to remove full control permission from S3 Bucket ACL.

source: accurics-stageone

Expand All @@ -18,4 +24,20 @@ resource "aws_s3_bucket" "accuricsbucketdemo" {
tags = {
Name = "bucketdemo"
}

server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
}
}

resource "aws_vpc" "<resource_name>" {
cidr_block = "<cidr>"

tags = {
Name = "main"
}
}