Terragaot local

[Winston1234567]

No description provided.

[prisma-cloud-devsecops]

  AWS S3 buckets do not have server side encryption
    Resource: aws_s3_bucket.data | ID: BC_AWS_S3_14

How to Fix

resource "aws_s3_bucket" "example" {
  ...
+ server_side_encryption_configuration {
+ 	rule {
+    	apply_server_side_encryption_by_default {
+      	sse_algorithm = "AES256"
+   	}
+ 	}
+	}
}

Description

SSE helps prevent unauthorized access to S3 buckets. Encrypting and decrypting data at the S3 bucket level is transparent to users when accessing data.

Benchmarks

• FEDRAMP (MODERATE) SC-28
• CIS AWS V1.3 2.1.1
• NIST-800-53 SC-2, AC-17
• PCI-DSS V3.2 3
• PCI-DSS V3.2.1 3.4

[prisma-cloud-devsecops]

  AWS S3 bucket ACL grants READ permission to everyone
    Resource: aws_s3_bucket.data | ID: BC_AWS_S3_1

How to Fix

resource "aws_s3_bucket" "data" {
	...
  bucket        = "${local.resource_prefix.value}-data"
-  acl           = "public-read"
+  acl           = "private"
}

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **READ** access to everyone can provide attackers the ability to read object data within the bucket, which can lead to the exposure of sensitive data. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for READ actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

• NIST-800-53 AC-17

🎉   Fixed by commit 5d4ec9c - new

[prisma-cloud-devsecops]

  AWS S3 Bucket has an ACL defined which allows public WRITE access
    Resource: aws_s3_bucket.data | ID: BC_AWS_S3_2

How to Fix

Type: AWS::S3::Bucket
    Properties:
    	...
-     AccessControl: PublicReadWrite

Description

Unprotected S3 buckets are one of the major causes of data theft and intrusions. An S3 bucket that allows **WRITE** access to everyone allows attackers to create, overwrite and delete objects within the bucket, which can lead to: S3 data loss, unintended changes to applications using that bucket, and unexpected charges. The only S3 buckets that should be globally accessible for unauthenticated users or for **Any AWS Authenticate Users** are those used for hosting static websites. Bucket ACL helps manage access to S3 bucket data.

We recommend AWS S3 buckets are not publicly accessible for WRITE actions to protect S3 data from unauthorized users and exposing sensitive data to public access.

Benchmarks

• NIST-800-53 AC-17

🎉   Fixed by commit 5d4ec9c - new

[prisma-cloud-devsecops]

  AWS Access logging not enabled on S3 buckets
    Resource: aws_s3_bucket.data | ID: BC_AWS_S3_13

How to Fix

resource "aws_s3_bucket" "bucket" {
  acl    = var.s3_bucket_acl
  bucket = var.s3_bucket_name
  policy = var.s3_bucket_policy

  force_destroy = var.s3_bucket_force_destroy
  versioning {
    enabled    = var.versioning
    mfa_delete = var.mfa_delete
  }

+  dynamic "logging" {
+    for_each = var.logging
+    content {
+      target_bucket = logging.value["target_bucket"]
+      target_prefix = "log/${var.s3_bucket_name}"
+    }
+  }
}

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

• HIPAA 164.312(B) Audit controls

🎉   Fixed by commit 5d4ec9c - new

[prisma-cloud-devsecops]

⚠️   Due to 5d4ec9c - new - 3 errors were fixed.

Change details

Error ID	Change	Path	Resource
BC_AWS_S3_13	Fixed	/s3.tf	aws_s3_bucket.data
BC_AWS_S3_1	Fixed	/s3.tf	aws_s3_bucket.data
BC_AWS_S3_2	Fixed	/s3.tf	aws_s3_bucket.data