This repository has been archived by the owner on Jan 23, 2025. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 119
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into liamg-aws-cis-1.4
- Loading branch information
Showing
707 changed files
with
8,677 additions
and
7,408 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
|
|
||
| Set the instance to not be publicly accessible | ||
|
|
||
| ```yaml | ||
| --- | ||
| Resources: | ||
| GoodExample: | ||
| Properties: | ||
| VpcId: vpc-123456 | ||
| Type: AWS::EC2::Subnet | ||
|
|
||
| ``` | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
|
|
||
| Set the instance to not be publicly accessible | ||
|
|
||
| ```hcl | ||
| resource "aws_subnet" "good_example" { | ||
| vpc_id = "vpc-123456" | ||
| map_public_ip_on_launch = false | ||
| } | ||
| ``` | ||
|
|
||
| #### Remediation Links | ||
| - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet#map_public_ip_on_launch | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
|
|
||
| You should limit the provision of public IP addresses for resources. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. | ||
|
|
||
| ### Impact | ||
| The instance is publicly accessible | ||
|
|
||
| <!-- DO NOT CHANGE --> | ||
| {{ remediationActions }} | ||
|
|
||
| ### Links | ||
| - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses | ||
|
|
||
|
|
14 changes: 14 additions & 0 deletions
14
avd_docs/github/branch_protections/AVD-GIT-0004/Terraform.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
|
|
||
| Require signed commits for a repository | ||
|
|
||
| ```hcl | ||
| resource "github_branch_protection" "good_example" { | ||
| repository_id = "example" | ||
| pattern = "main" | ||
| require_signed_commits = true | ||
| } | ||
| ``` | ||
|
|
||
| #### Remediation Links | ||
| - https://registry.terraform.io/providers/integrations/github/latest/docs/resources/branch_protection#require_signed_commits |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
|
|
||
| GitHub branch protection should be set to require signed commits. | ||
|
|
||
| You can do this by setting the <code>require_signed_commits</code> attribute to 'true'. | ||
|
|
||
| ### Impact | ||
| Commits may not be verified and signed as coming from a trusted developer | ||
|
|
||
| <!-- DO NOT CHANGE --> | ||
| {{ remediationActions }} | ||
|
|
||
| ### Links | ||
| - https://registry.terraform.io/providers/integrations/github/latest/docs/resources/branch_protection#require_signed_commits | ||
|
|
||
| - https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification | ||
|
|
||
| - https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches#require-signed-commits | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.