Sync github #48
Merged
Sync github #48
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| attributes = ["${compact(concat(var.attributes, list("datapipeline")))}"] | ||
| tags = "${var.tags}" | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "aws_cloudformation_stack" "datapipeline" { |
There was a problem hiding this comment.
Ensure AWS CloudFormation stacks are sending event notifications to an SNS topic
Resource: aws_cloudformation_stack.datapipeline | Bridgecrew ID: BC_AWS_LOGGING_25 | Checkov ID: CKV_AWS_124
How to Fix
resource "aws_cloudformation_stack" "default" {
name = "networking-stack"
...
+ notification_arns = ["arn1", "arn2"]
}Description
Enabling event notifications for your AWS CloudFormation stacks can help you to monitor and track changes to your stacks. When event notifications are enabled, CloudFormation will send a message to an Amazon Simple Notification Service (SNS) topic each time a stack event occurs. By doing so, you will improve your visibility and automation processes (if desired).| attributes = ["${compact(concat(var.attributes, list("logs")))}"] | ||
| tags = "${var.tags}" | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "aws_s3_bucket" "logs" { |
There was a problem hiding this comment.
Ensure S3 Bucket has public access blocks
Resource: aws_s3_bucket.logs | Bridgecrew ID: BC_AWS_NETWORKING_52 | Checkov ID: CKV2_AWS_6
How to Fix
resource "aws_s3_bucket" "bucket_good_1" {
bucket = "bucket_good"
}
resource "aws_s3_bucket_public_access_block" "access_good_1" {
bucket = aws_s3_bucket.bucket_good_1.id
block_public_acls = true
block_public_policy = true
}
Description
When you create an S3 bucket, it is good practice to set the additional resource **aws_s3_bucket_public_access_block** to ensure the bucket is never accidentally public.We recommend you ensure S3 bucket has public access blocks. If the public access block is not attached it defaults to False.
| attributes = ["${compact(concat(var.attributes, list("backups")))}"] | ||
| tags = "${var.tags}" | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "aws_s3_bucket" "backups" { |
There was a problem hiding this comment.
Ensure S3 Bucket has public access blocks
Resource: aws_s3_bucket.backups | Bridgecrew ID: BC_AWS_NETWORKING_52 | Checkov ID: CKV2_AWS_6
How to Fix
resource "aws_s3_bucket" "bucket_good_1" {
bucket = "bucket_good"
}
resource "aws_s3_bucket_public_access_block" "access_good_1" {
bucket = aws_s3_bucket.bucket_good_1.id
block_public_acls = true
block_public_policy = true
}
Description
When you create an S3 bucket, it is good practice to set the additional resource **aws_s3_bucket_public_access_block** to ensure the bucket is never accidentally public.We recommend you ensure S3 bucket has public access blocks. If the public access block is not attached it defaults to False.
| attributes = ["${compact(concat(var.attributes, list("logs")))}"] | ||
| tags = "${var.tags}" | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "aws_s3_bucket" "logs" { |
There was a problem hiding this comment.
Suggested change
| resource "aws_s3_bucket" "logs" { | |
| resource "aws_s3_bucket" "logs" { | |
| bucket = module.logs_label.id | |
| force_destroy = true | |
| tags = module.logs_label.tags | |
| } | |
| resource "aws_s3_bucket_versioning" "logs" { | |
| bucket = aws_s3_bucket.logs.id | |
| versioning_configuration { | |
| status = "Enabled" | |
| } | |
| } | |
Ensure AWS S3 object versioning is enabled
Resource: aws_s3_bucket.logs | Bridgecrew ID: BC_AWS_S3_16 | Checkov ID: CKV_AWS_21
How to Fix
resource "aws_s3_bucket" "state_bucket" {
bucket = "${data.aws_caller_identity.current.account_id}-terraform-state"
acl = var.acl
force_destroy = var.force_destroy
+ versioning {
+ enabled = true
+ }
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = var.sse_algorithm
}
}
}
tags = var.common_tags
}Description
S3 versioning is a managed data backup and recovery service provided by AWS. When enabled it allows users to retrieve and restore previous versions of their buckets.S3 versioning can be used for data protection and retention scenarios such as recovering objects that have been accidentally/intentionally deleted or overwritten.
Benchmarks
- FEDRAMP (MODERATE) CP-10, SI-12
- PCI-DSS V3.2.1 10.5.3
🪄 Smart Fix -
Fix based on 100% past actions in this repository| @@ -1,9 +1,9 @@ | |||
| resource "aws_security_group" "datapipeline" { | |||
There was a problem hiding this comment.
Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.datapipeline | Bridgecrew ID: BC_AWS_NETWORKING_51 | Checkov ID: CKV2_AWS_5
How to Fix
resource "aws_network_interface" "test" {
subnet_id = "aws_subnet.public_a.id"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_instance" "test" {
ami = "data.aws_ami.ubuntu.id"
instance_type = "t3.micro"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_security_group" "ok_sg" {
ingress {
description = "TLS from VPC"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = 0.0.0.0/0
}
}
Description
Security groups are an important layer of security for Amazon EC2 instances and network interfaces (ENIs). They act as a virtual firewall for your instances, controlling inbound and outbound traffic to and from your instances. By attaching security groups to your EC2 instances or ENIs, you can specify which traffic is allowed to reach your instances, and which traffic is blocked. This can help to protect your instances from unauthorized access and prevent potential security vulnerabilities.| attributes = ["${compact(concat(var.attributes, list("sns")))}"] | ||
| tags = "${var.tags}" | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "aws_cloudformation_stack" "sns" { |
There was a problem hiding this comment.
Ensure AWS CloudFormation stacks are sending event notifications to an SNS topic
Resource: aws_cloudformation_stack.sns | Bridgecrew ID: BC_AWS_LOGGING_25 | Checkov ID: CKV_AWS_124
How to Fix
resource "aws_cloudformation_stack" "default" {
name = "networking-stack"
...
+ notification_arns = ["arn1", "arn2"]
}Description
Enabling event notifications for your AWS CloudFormation stacks can help you to monitor and track changes to your stacks. When event notifications are enabled, CloudFormation will send a message to an Amazon Simple Notification Service (SNS) topic each time a stack event occurs. By doing so, you will improve your visibility and automation processes (if desired).| @@ -1,9 +1,9 @@ | |||
| resource "aws_security_group" "datapipeline" { | |||
There was a problem hiding this comment.
Ensure every Security Group rule has a description
Resource: aws_security_group.datapipeline | Bridgecrew ID: BC_AWS_NETWORKING_31 | Checkov ID: CKV_AWS_23
How to Fix
resource "aws_security_group" "examplea" {
name = var.es_domain
description = "Allow inbound traffic to ElasticSearch from VPC CIDR"
vpc_id = var.vpc
ingress {
cidr_blocks = ["10.0.0.0/16"]
+ description = "What does this rule enable"
from_port = 80
protocol = "tcp"
to_port = 80
}
}Description
Descriptions can be up to 255 characters long and can be set and viewed from the AWS Management Console, AWS Command Line Interface (CLI), and the AWS APIs.We recommend you add descriptive text to each of your Security Group Rules clarifying each rule's goals, this helps prevent developer errors.
Benchmarks
- ISO27001 A.10.1.1
- SOC2 CC6.3.3
| @@ -1,9 +1,9 @@ | |||
| resource "aws_security_group" "datapipeline" { | |||
There was a problem hiding this comment.
Ensure AWS Security Group does not allow all traffic on SSH port 22
Resource: aws_security_group.datapipeline | Bridgecrew ID: BC_AWS_NETWORKING_1 | Checkov ID: CKV_AWS_24
How to Fix
resource "aws_security_group" "example" {
...
ingress {
cidr_blocks = [
- "0.0.0.0/0"
+ "10.0.0.1/32"
]
from_port = 22
to_port = 22
protocol = "tcp"
}
}Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.Benchmarks
- CIS AWS V1.2 4.1
- CIS AWS V1.3 5.2
- FEDRAMP (MODERATE) AC-4, SC-7, SC-7(3)
- HIPAA 164.312(E)(1)
- ISO27001 A.10.1.1
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- PCI-DSS V3.2.1 1.2.1, 1.3, 2.2.2
- PCI-DSS V3.2 2
- SOC2 CC6.3.3
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Rebuild github dir from the template