diff --git a/avd_docs/aws/apigateway/AVD-AWS-0001/CloudFormation.md b/avd_docs/aws/apigateway/AVD-AWS-0001/CloudFormation.md index a5709df46..56f55d901 100644 --- a/avd_docs/aws/apigateway/AVD-AWS-0001/CloudFormation.md +++ b/avd_docs/aws/apigateway/AVD-AWS-0001/CloudFormation.md @@ -1,10 +1,9 @@ Enable logging for API Gateway stages -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- +AWSTemplateFormatVersion: 2010-09-09 +Description: Good Example of ApiGateway Resources: GoodApi: Type: AWS::ApiGatewayV2::Api @@ -16,4 +15,7 @@ Resources: Format: json ApiId: !Ref GoodApi StageName: GoodApiStage + ``` + + diff --git a/avd_docs/aws/apigateway/AVD-AWS-0001/Terraform.md b/avd_docs/aws/apigateway/AVD-AWS-0001/Terraform.md index d2bbddf71..9c220637b 100644 --- a/avd_docs/aws/apigateway/AVD-AWS-0001/Terraform.md +++ b/avd_docs/aws/apigateway/AVD-AWS-0001/Terraform.md @@ -2,28 +2,29 @@ Enable logging for API Gateway stages ```hcl -resource "aws_apigatewayv2_stage" "good_example" { - api_id = aws_apigatewayv2_api.example.id - name = "example-stage" - - access_log_settings { - destination_arn = "" - format = "" - } -} - -resource "aws_api_gateway_stage" "good_example" { - deployment_id = aws_api_gateway_deployment.example.id - rest_api_id = aws_api_gateway_rest_api.example.id - stage_name = "example" - - access_log_settings { - destination_arn = "" - format = "" - } -} + resource "aws_apigatewayv2_stage" "good_example" { + api_id = aws_apigatewayv2_api.example.id + name = "example-stage" + + access_log_settings { + destination_arn = "arn:aws:logs:region:0123456789:log-group:access_logging" + format = "json" + } + } + + resource "aws_api_gateway_stage" "good_example" { + deployment_id = aws_api_gateway_deployment.example.id + rest_api_id = aws_api_gateway_rest_api.example.id + stage_name = "example" + + access_log_settings { + destination_arn = "arn:aws:logs:region:0123456789:log-group:access_logging" + format = "json" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/apigatewayv2_stage#access_log_settings - \ No newline at end of file + diff --git a/avd_docs/aws/apigateway/AVD-AWS-0002/Terraform.md b/avd_docs/aws/apigateway/AVD-AWS-0002/Terraform.md index 2654b683b..6d0a04e06 100644 --- a/avd_docs/aws/apigateway/AVD-AWS-0002/Terraform.md +++ b/avd_docs/aws/apigateway/AVD-AWS-0002/Terraform.md @@ -2,27 +2,29 @@ Enable cache encryption ```hcl -resource "aws_api_gateway_rest_api" "example" { - -} + resource "aws_api_gateway_rest_api" "example" { + + } -resource "aws_api_gateway_stage" "example" { - -} + resource "aws_api_gateway_stage" "example" { -resource "aws_api_gateway_method_settings" "good_example" { - rest_api_id = aws_api_gateway_rest_api.example.id - stage_name = aws_api_gateway_stage.example.stage_name - method_path = "path1/GET" - - settings { - metrics_enabled = true - logging_level = "INFO" - cache_data_encrypted = true - } -} + } + + resource "aws_api_gateway_method_settings" "good_example" { + rest_api_id = aws_api_gateway_rest_api.example.id + stage_name = aws_api_gateway_stage.example.stage_name + method_path = "path1/GET" + + settings { + metrics_enabled = true + logging_level = "INFO" + caching_enabled = true + cache_data_encrypted = true + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_settings#cache_data_encrypted - \ No newline at end of file + diff --git a/avd_docs/aws/apigateway/AVD-AWS-0003/Terraform.md b/avd_docs/aws/apigateway/AVD-AWS-0003/Terraform.md index 9cb06bfd1..0feb27312 100644 --- a/avd_docs/aws/apigateway/AVD-AWS-0003/Terraform.md +++ b/avd_docs/aws/apigateway/AVD-AWS-0003/Terraform.md @@ -2,18 +2,19 @@ Enable tracing ```hcl -resource "aws_api_gateway_rest_api" "test" { - -} + resource "aws_api_gateway_rest_api" "test" { + + } -resource "aws_api_gateway_stage" "good_example" { - stage_name = "prod" - rest_api_id = aws_api_gateway_rest_api.test.id - deployment_id = aws_api_gateway_deployment.test.id - xray_tracing_enabled = true -} + resource "aws_api_gateway_stage" "good_example" { + stage_name = "prod" + rest_api_id = aws_api_gateway_rest_api.test.id + deployment_id = aws_api_gateway_deployment.test.id + xray_tracing_enabled = true + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_stage#xray_tracing_enabled - \ No newline at end of file + diff --git a/avd_docs/aws/apigateway/AVD-AWS-0004/Terraform.md b/avd_docs/aws/apigateway/AVD-AWS-0004/Terraform.md index 6d3fb3e7a..102ec3c02 100644 --- a/avd_docs/aws/apigateway/AVD-AWS-0004/Terraform.md +++ b/avd_docs/aws/apigateway/AVD-AWS-0004/Terraform.md @@ -2,18 +2,58 @@ Use and authorization method or require API Key ```hcl -resource "aws_api_gateway_rest_api" "MyDemoAPI" { - -} - -resource "aws_api_gateway_method" "good_example" { - rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id - resource_id = aws_api_gateway_resource.MyDemoResource.id - http_method = "GET" - authorization = "AWS_IAM" -} + resource "aws_api_gateway_rest_api" "MyDemoAPI" { + + } + + resource "aws_api_gateway_resource" "MyDemoResource" { + rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id + } + + resource "aws_api_gateway_method" "good_example" { + rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id + resource_id = aws_api_gateway_resource.MyDemoResource.id + http_method = "GET" + authorization = "AWS_IAM" + } + +``` +```hcl + resource "aws_api_gateway_rest_api" "MyDemoAPI" { + + } + + resource "aws_api_gateway_resource" "MyDemoResource" { + rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id + } + + resource "aws_api_gateway_method" "good_example" { + rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id + resource_id = aws_api_gateway_resource.MyDemoResource.id + http_method = "GET" + authorization = "NONE" + api_key_required = true + } + +``` +```hcl + resource "aws_api_gateway_rest_api" "MyDemoAPI" { + + } + + resource "aws_api_gateway_resource" "MyDemoResource" { + rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id + } + + resource "aws_api_gateway_method" "good_example" { + rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id + resource_id = aws_api_gateway_resource.MyDemoResource.id + http_method = "OPTION" + authorization = "NONE" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method#authorization - \ No newline at end of file + diff --git a/avd_docs/aws/apigateway/AVD-AWS-0005/Terraform.md b/avd_docs/aws/apigateway/AVD-AWS-0005/Terraform.md index 5e77f8f52..e7cd3ef00 100644 --- a/avd_docs/aws/apigateway/AVD-AWS-0005/Terraform.md +++ b/avd_docs/aws/apigateway/AVD-AWS-0005/Terraform.md @@ -2,11 +2,12 @@ Use the most modern TLS/SSL policies available ```hcl -resource "aws_api_gateway_domain_name" "good_example" { - security_policy = "TLS_1_2" -} + resource "aws_api_gateway_domain_name" "good_example" { + security_policy = "TLS_1_2" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_domain_name#security_policy - \ No newline at end of file + diff --git a/avd_docs/aws/athena/AVD-AWS-0006/CloudFormation.md b/avd_docs/aws/athena/AVD-AWS-0006/CloudFormation.md index dec1f5f09..8fbe3d37c 100644 --- a/avd_docs/aws/athena/AVD-AWS-0006/CloudFormation.md +++ b/avd_docs/aws/athena/AVD-AWS-0006/CloudFormation.md @@ -1,10 +1,7 @@ Enable encryption at rest for Athena databases and workgroup configurations -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Properties: @@ -14,4 +11,7 @@ Resources: EncryptionConfiguration: EncryptionOption: SSE_KMS Type: AWS::Athena::WorkGroup + ``` + + diff --git a/avd_docs/aws/athena/AVD-AWS-0006/Terraform.md b/avd_docs/aws/athena/AVD-AWS-0006/Terraform.md index 729fe213e..b59ec1cdb 100644 --- a/avd_docs/aws/athena/AVD-AWS-0006/Terraform.md +++ b/avd_docs/aws/athena/AVD-AWS-0006/Terraform.md @@ -2,36 +2,38 @@ Enable encryption at rest for Athena databases and workgroup configurations ```hcl -resource "aws_athena_database" "good_example" { - name = "database_name" - bucket = aws_s3_bucket.hoge.bucket - - encryption_configuration { - encryption_option = "SSE_KMS" - kms_key_arn = aws_kms_key.example.arn + resource "aws_athena_database" "good_example" { + name = "database_name" + bucket = aws_s3_bucket.hoge.bucket + + encryption_configuration { + encryption_option = "SSE_KMS" + kms_key_arn = aws_kms_key.example.arn } -} - -resource "aws_athena_workgroup" "good_example" { - name = "example" - - configuration { - enforce_workgroup_configuration = true - publish_cloudwatch_metrics_enabled = true - - result_configuration { - output_location = "s3://${aws_s3_bucket.example.bucket}/output/" - - encryption_configuration { - encryption_option = "SSE_KMS" - kms_key_arn = aws_kms_key.example.arn - } - } - } -} + } + + resource "aws_athena_workgroup" "good_example" { + name = "example" + + configuration { + enforce_workgroup_configuration = true + publish_cloudwatch_metrics_enabled = true + + result_configuration { + output_location = "s3://${aws_s3_bucket.example.bucket}/output/" + + encryption_configuration { + encryption_option = "SSE_KMS" + kms_key_arn = aws_kms_key.example.arn + } + } + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_workgroup#encryption_configuration + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_database#encryption_configuration - \ No newline at end of file + diff --git a/avd_docs/aws/athena/AVD-AWS-0007/CloudFormation.md b/avd_docs/aws/athena/AVD-AWS-0007/CloudFormation.md index 003914a2e..be71571ce 100644 --- a/avd_docs/aws/athena/AVD-AWS-0007/CloudFormation.md +++ b/avd_docs/aws/athena/AVD-AWS-0007/CloudFormation.md @@ -1,10 +1,7 @@ Enforce the configuration to prevent client overrides -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Properties: @@ -15,4 +12,7 @@ Resources: EncryptionConfiguration: EncryptionOption: SSE_KMS Type: AWS::Athena::WorkGroup + ``` + + diff --git a/avd_docs/aws/athena/AVD-AWS-0007/Terraform.md b/avd_docs/aws/athena/AVD-AWS-0007/Terraform.md index cd6a0a928..4da01fe85 100644 --- a/avd_docs/aws/athena/AVD-AWS-0007/Terraform.md +++ b/avd_docs/aws/athena/AVD-AWS-0007/Terraform.md @@ -2,25 +2,26 @@ Enforce the configuration to prevent client overrides ```hcl -resource "aws_athena_workgroup" "good_example" { - name = "example" - - configuration { - enforce_workgroup_configuration = true - publish_cloudwatch_metrics_enabled = true - - result_configuration { - output_location = "s3://${aws_s3_bucket.example.bucket}/output/" - - encryption_configuration { - encryption_option = "SSE_KMS" - kms_key_arn = aws_kms_key.example.arn - } - } - } -} + resource "aws_athena_workgroup" "good_example" { + name = "example" + + configuration { + enforce_workgroup_configuration = true + publish_cloudwatch_metrics_enabled = true + + result_configuration { + output_location = "s3://${aws_s3_bucket.example.bucket}/output/" + + encryption_configuration { + encryption_option = "SSE_KMS" + kms_key_arn = aws_kms_key.example.arn + } + } + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_workgroup#configuration - \ No newline at end of file + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0010/CloudFormation.md b/avd_docs/aws/cloudfront/AVD-AWS-0010/CloudFormation.md index 834c9f1bc..51f56f9d3 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0010/CloudFormation.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0010/CloudFormation.md @@ -1,10 +1,7 @@ Enable logging for CloudFront distributions -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Properties: @@ -19,4 +16,7 @@ Resources: - DomainName: https://some.domain Id: somedomain1 Type: AWS::CloudFront::Distribution + ``` + + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0010/Terraform.md b/avd_docs/aws/cloudfront/AVD-AWS-0010/Terraform.md index 479bed3c5..ae92e5309 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0010/Terraform.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0010/Terraform.md @@ -2,16 +2,17 @@ Enable logging for CloudFront distributions ```hcl -resource "aws_cloudfront_distribution" "good_example" { - // other config - logging_config { - include_cookies = false - bucket = "mylogs.s3.amazonaws.com" - prefix = "myprefix" - } -} + resource "aws_cloudfront_distribution" "good_example" { + // other config + logging_config { + include_cookies = false + bucket = "mylogs.s3.amazonaws.com" + prefix = "myprefix" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#logging_config - \ No newline at end of file + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0011/CloudFormation.md b/avd_docs/aws/cloudfront/AVD-AWS-0011/CloudFormation.md index 3b759abb6..044d621f0 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0011/CloudFormation.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0011/CloudFormation.md @@ -1,10 +1,7 @@ Enable WAF for the CloudFront distribution -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Properties: @@ -20,4 +17,7 @@ Resources: Id: somedomain1 WebACLId: waf_id Type: AWS::CloudFront::Distribution + ``` + + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0011/Terraform.md b/avd_docs/aws/cloudfront/AVD-AWS-0011/Terraform.md index ac80547b7..d9558fc91 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0011/Terraform.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0011/Terraform.md @@ -2,34 +2,35 @@ Enable WAF for the CloudFront distribution ```hcl -resource "aws_cloudfront_distribution" "good_example" { - - origin { - domain_name = aws_s3_bucket.primary.bucket_regional_domain_name - origin_id = "primaryS3" - - s3_origin_config { - origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path - } - } - - origin { - domain_name = aws_s3_bucket.failover.bucket_regional_domain_name - origin_id = "failoverS3" - - s3_origin_config { - origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path - } - } - - default_cache_behavior { - target_origin_id = "groupS3" - } - - web_acl_id = "waf_id" -} + resource "aws_cloudfront_distribution" "good_example" { + + origin { + domain_name = aws_s3_bucket.primary.bucket_regional_domain_name + origin_id = "primaryS3" + + s3_origin_config { + origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path + } + } + + origin { + domain_name = aws_s3_bucket.failover.bucket_regional_domain_name + origin_id = "failoverS3" + + s3_origin_config { + origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path + } + } + + default_cache_behavior { + target_origin_id = "groupS3" + } + + web_acl_id = "waf_id" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#web_acl_id - \ No newline at end of file + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0012/CloudFormation.md b/avd_docs/aws/cloudfront/AVD-AWS-0012/CloudFormation.md index d7877e60a..6e8bc873c 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0012/CloudFormation.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0012/CloudFormation.md @@ -1,10 +1,7 @@ Only allow HTTPS for CloudFront distribution communication -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Properties: @@ -20,4 +17,7 @@ Resources: Id: somedomain1 WebACLId: waf_id Type: AWS::CloudFront::Distribution + ``` + + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0012/Terraform.md b/avd_docs/aws/cloudfront/AVD-AWS-0012/Terraform.md index 2c4c1b86a..3387e8ea1 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0012/Terraform.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0012/Terraform.md @@ -2,13 +2,14 @@ Only allow HTTPS for CloudFront distribution communication ```hcl -resource "aws_cloudfront_distribution" "good_example" { - default_cache_behavior { - viewer_protocol_policy = "redirect-to-https" - } -} + resource "aws_cloudfront_distribution" "good_example" { + default_cache_behavior { + viewer_protocol_policy = "redirect-to-https" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#viewer_protocol_policy - \ No newline at end of file + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0013/CloudFormation.md b/avd_docs/aws/cloudfront/AVD-AWS-0013/CloudFormation.md index 9a2052aca..9702ba05e 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0013/CloudFormation.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0013/CloudFormation.md @@ -1,10 +1,7 @@ Use the most modern TLS/SSL policies available -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Properties: @@ -21,4 +18,7 @@ Resources: ViewerCertificate: MinimumProtocolVersion: TLSv1.2_2021 Type: AWS::CloudFront::Distribution + ``` + + diff --git a/avd_docs/aws/cloudfront/AVD-AWS-0013/Terraform.md b/avd_docs/aws/cloudfront/AVD-AWS-0013/Terraform.md index 4316bada5..981514037 100644 --- a/avd_docs/aws/cloudfront/AVD-AWS-0013/Terraform.md +++ b/avd_docs/aws/cloudfront/AVD-AWS-0013/Terraform.md @@ -2,14 +2,15 @@ Use the most modern TLS/SSL policies available ```hcl -resource "aws_cloudfront_distribution" "good_example" { - viewer_certificate { - cloudfront_default_certificate = true - minimum_protocol_version = "TLSv1.2_2021" - } -} + resource "aws_cloudfront_distribution" "good_example" { + viewer_certificate { + cloudfront_default_certificate = aws_acm_certificate.example.arn + minimum_protocol_version = "TLSv1.2_2021" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#minimum_protocol_version - \ No newline at end of file + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0014/CloudFormation.md b/avd_docs/aws/cloudtrail/AVD-AWS-0014/CloudFormation.md index b08da1525..6f69815d4 100644 --- a/avd_docs/aws/cloudtrail/AVD-AWS-0014/CloudFormation.md +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0014/CloudFormation.md @@ -1,10 +1,7 @@ Enable Cloudtrail in all regions -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: BadExample: Type: AWS::CloudTrail::Trail @@ -14,4 +11,7 @@ Resources: S3BucketName: "CloudtrailBucket" S3KeyPrefix: "/trailing" TrailName: "Cloudtrail" + ``` + + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0014/Terraform.md b/avd_docs/aws/cloudtrail/AVD-AWS-0014/Terraform.md index 3667f48a8..254aa7d49 100644 --- a/avd_docs/aws/cloudtrail/AVD-AWS-0014/Terraform.md +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0014/Terraform.md @@ -2,21 +2,22 @@ Enable Cloudtrail in all regions ```hcl -resource "aws_cloudtrail" "good_example" { - is_multi_region_trail = true - - event_selector { - read_write_type = "All" - include_management_events = true - - data_resource { - type = "AWS::S3::Object" - values = ["${data.aws_s3_bucket.important-bucket.arn}/"] - } - } -} + resource "aws_cloudtrail" "good_example" { + is_multi_region_trail = true + + event_selector { + read_write_type = "All" + include_management_events = true + + data_resource { + type = "AWS::S3::Object" + values = ["${data.aws_s3_bucket.important-bucket.arn}/"] + } + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail#is_multi_region_trail - \ No newline at end of file + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0015/CloudFormation.md b/avd_docs/aws/cloudtrail/AVD-AWS-0015/CloudFormation.md index 49a5a22ab..b17b69fec 100644 --- a/avd_docs/aws/cloudtrail/AVD-AWS-0015/CloudFormation.md +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0015/CloudFormation.md @@ -1,10 +1,7 @@ Enable encryption at rest -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: BadExample: Type: AWS::CloudTrail::Trail @@ -15,4 +12,7 @@ Resources: S3BucketName: "CloudtrailBucket" S3KeyPrefix: "/trailing" TrailName: "Cloudtrail" + ``` + + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0015/Terraform.md b/avd_docs/aws/cloudtrail/AVD-AWS-0015/Terraform.md index 00084007e..befbea4fc 100644 --- a/avd_docs/aws/cloudtrail/AVD-AWS-0015/Terraform.md +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0015/Terraform.md @@ -2,23 +2,24 @@ Enable encryption at rest ```hcl -resource "aws_cloudtrail" "good_example" { - is_multi_region_trail = true - enable_log_file_validation = true - kms_key_id = var.kms_id - - event_selector { - read_write_type = "All" - include_management_events = true - - data_resource { - type = "AWS::S3::Object" - values = ["${data.aws_s3_bucket.important-bucket.arn}/"] - } - } -} + resource "aws_cloudtrail" "good_example" { + is_multi_region_trail = true + enable_log_file_validation = true + kms_key_id = var.kms_id + + event_selector { + read_write_type = "All" + include_management_events = true + + data_resource { + type = "AWS::S3::Object" + values = ["${data.aws_s3_bucket.important-bucket.arn}/"] + } + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail#kms_key_id - \ No newline at end of file + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0016/CloudFormation.md b/avd_docs/aws/cloudtrail/AVD-AWS-0016/CloudFormation.md index 001dbb50f..bb9a815c5 100644 --- a/avd_docs/aws/cloudtrail/AVD-AWS-0016/CloudFormation.md +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0016/CloudFormation.md @@ -1,10 +1,7 @@ Turn on log validation for Cloudtrail -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: BadExample: Type: AWS::CloudTrail::Trail @@ -15,4 +12,7 @@ Resources: S3BucketName: "CloudtrailBucket" S3KeyPrefix: "/trailing" TrailName: "Cloudtrail" + ``` + + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0016/Terraform.md b/avd_docs/aws/cloudtrail/AVD-AWS-0016/Terraform.md index e100368be..f5e1c895f 100644 --- a/avd_docs/aws/cloudtrail/AVD-AWS-0016/Terraform.md +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0016/Terraform.md @@ -2,22 +2,23 @@ Turn on log validation for Cloudtrail ```hcl -resource "aws_cloudtrail" "good_example" { - is_multi_region_trail = true - enable_log_file_validation = true - - event_selector { - read_write_type = "All" - include_management_events = true - - data_resource { - type = "AWS::S3::Object" - values = ["${data.aws_s3_bucket.important-bucket.arn}/"] - } - } -} + resource "aws_cloudtrail" "good_example" { + is_multi_region_trail = true + enable_log_file_validation = true + + event_selector { + read_write_type = "All" + include_management_events = true + + data_resource { + type = "AWS::S3::Object" + values = ["${data.aws_s3_bucket.important-bucket.arn}/"] + } + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail#enable_log_file_validation - \ No newline at end of file + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0161/CloudFormation.md b/avd_docs/aws/cloudtrail/AVD-AWS-0161/CloudFormation.md new file mode 100644 index 000000000..764810725 --- /dev/null +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0161/CloudFormation.md @@ -0,0 +1,20 @@ + +Restrict public access to the S3 bucket + +```yaml--- +Resources: + GoodExampleTrail: + Type: AWS::CloudTrail::Trail + Properties: + IsLogging: true + S3BucketName: "my-bucket" + TrailName: "Cloudtrail" + GoodExampleBucket: + Type: AWS::S3::Bucket + Properties: + BucketName: "my-bucket" + AccessControl: Private + +``` + + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0161/Terraform.md b/avd_docs/aws/cloudtrail/AVD-AWS-0161/Terraform.md new file mode 100644 index 000000000..bc14a8754 --- /dev/null +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0161/Terraform.md @@ -0,0 +1,29 @@ + +Restrict public access to the S3 bucket + +```hcl + resource "aws_cloudtrail" "good_example" { + is_multi_region_trail = true + s3_bucket_name = "abcdefgh" + + event_selector { + read_write_type = "All" + include_management_events = true + + data_resource { + type = "AWS::S3::Object" + values = ["${data.aws_s3_bucket.important-bucket.arn}/"] + } + } + } + +resource "aws_s3_bucket" "good_example" { + bucket = "abcdefgh" + acl = "private" +} + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail#is_multi_region_trail + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0162/CloudFormation.md b/avd_docs/aws/cloudtrail/AVD-AWS-0162/CloudFormation.md new file mode 100644 index 000000000..e7e20897f --- /dev/null +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0162/CloudFormation.md @@ -0,0 +1,14 @@ + +Enable logging to CloudWatch + +```yaml--- +Resources: + GoodExampleTrail: + Type: AWS::CloudTrail::Trail + Properties: + TrailName: "Cloudtrail" + CloudWatchLogsLogGroupArn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*" + +``` + + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0162/Terraform.md b/avd_docs/aws/cloudtrail/AVD-AWS-0162/Terraform.md new file mode 100644 index 000000000..493ed0dd8 --- /dev/null +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0162/Terraform.md @@ -0,0 +1,29 @@ + +Enable logging to CloudWatch + +```hcl + resource "aws_cloudtrail" "good_example" { + is_multi_region_trail = true + cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.example.arn}:*" + + + event_selector { + read_write_type = "All" + include_management_events = true + + data_resource { + type = "AWS::S3::Object" + values = ["${data.aws_s3_bucket.important-bucket.arn}/"] + } + } + } + +resource "aws_cloudwatch_log_group" "example" { + name = "Example" +} + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0163/CloudFormation.md b/avd_docs/aws/cloudtrail/AVD-AWS-0163/CloudFormation.md new file mode 100644 index 000000000..4fcfa1396 --- /dev/null +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0163/CloudFormation.md @@ -0,0 +1,22 @@ + +Enable access logging on the bucket + +```yaml--- +Resources: + GoodExampleTrail: + Type: AWS::CloudTrail::Trail + Properties: + IsLogging: true + S3BucketName: "my-bucket" + TrailName: "Cloudtrail" + GoodExampleBucket: + Type: AWS::S3::Bucket + Properties: + BucketName: "my-bucket" + LoggingConfiguration: + DestinationBucketName: logging-bucket + LogFilePrefix: accesslogs/ + +``` + + diff --git a/avd_docs/aws/cloudtrail/AVD-AWS-0163/Terraform.md b/avd_docs/aws/cloudtrail/AVD-AWS-0163/Terraform.md new file mode 100644 index 000000000..3fff0e5c7 --- /dev/null +++ b/avd_docs/aws/cloudtrail/AVD-AWS-0163/Terraform.md @@ -0,0 +1,31 @@ + +Enable access logging on the bucket + +```hcl + resource "aws_cloudtrail" "good_example" { + is_multi_region_trail = true + s3_bucket_name = "abcdefgh" + + event_selector { + read_write_type = "All" + include_management_events = true + + data_resource { + type = "AWS::S3::Object" + values = ["${data.aws_s3_bucket.important-bucket.arn}/"] + } + } + } + +resource "aws_s3_bucket" "good_example" { + bucket = "abcdefgh" + logging { + target_bucket = "target-bucket" + } +} + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail#is_multi_region_trail + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0017/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0017/CloudFormation.md index 6975606a8..51028be22 100644 --- a/avd_docs/aws/cloudwatch/AVD-AWS-0017/CloudFormation.md +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0017/CloudFormation.md @@ -1,10 +1,7 @@ Enable CMK encryption of CloudWatch Log Groups -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Type: AWS::Logs::LogGroup @@ -12,4 +9,7 @@ Resources: KmsKeyId: "arn:aws:kms:us-west-2:111122223333:key/lambdalogging" LogGroupName: "aws/lambda/goodExample" RetentionInDays: 30 + ``` + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0017/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0017/Terraform.md index 780417c8c..1909e47da 100644 --- a/avd_docs/aws/cloudwatch/AVD-AWS-0017/Terraform.md +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0017/Terraform.md @@ -2,13 +2,14 @@ Enable CMK encryption of CloudWatch Log Groups ```hcl -resource "aws_cloudwatch_log_group" "good_example" { - name = "good_example" - - kms_key_id = aws_kms_key.log_key.arn -} + resource "aws_cloudwatch_log_group" "good_example" { + name = "good_example" + + kms_key_id = aws_kms_key.log_key.arn + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id - \ No newline at end of file + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0147/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0147/CloudFormation.md new file mode 100644 index 000000000..e9b82fad0 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0147/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on unauthorized API calls + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0147/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0147/Terraform.md new file mode 100644 index 000000000..e9b82fad0 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0147/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on unauthorized API calls + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0148/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0148/CloudFormation.md new file mode 100644 index 000000000..ef7de47cf --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0148/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on non MFA logins + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0148/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0148/Terraform.md new file mode 100644 index 000000000..ef7de47cf --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0148/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on non MFA logins + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0149/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0149/CloudFormation.md new file mode 100644 index 000000000..793070477 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0149/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on root user login + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0149/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0149/Terraform.md new file mode 100644 index 000000000..793070477 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0149/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on root user login + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0150/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0150/CloudFormation.md new file mode 100644 index 000000000..7c7215228 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0150/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on IAM Policy changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0150/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0150/Terraform.md new file mode 100644 index 000000000..7c7215228 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0150/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on IAM Policy changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0151/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0151/CloudFormation.md new file mode 100644 index 000000000..baaae93aa --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0151/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on CloudTrail configuration changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0151/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0151/Terraform.md new file mode 100644 index 000000000..baaae93aa --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0151/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on CloudTrail configuration changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0152/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0152/CloudFormation.md new file mode 100644 index 000000000..163f2f8dc --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0152/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on console login failures + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0152/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0152/Terraform.md new file mode 100644 index 000000000..163f2f8dc --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0152/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on console login failures + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0153/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0153/CloudFormation.md new file mode 100644 index 000000000..1eeab6a2e --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0153/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on CMKs being disabled or scheduled for deletion + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0153/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0153/Terraform.md new file mode 100644 index 000000000..1eeab6a2e --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0153/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on CMKs being disabled or scheduled for deletion + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0154/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0154/CloudFormation.md new file mode 100644 index 000000000..cc7958c8b --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0154/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on S3 Bucket policy changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0154/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0154/Terraform.md new file mode 100644 index 000000000..cc7958c8b --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0154/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on S3 Bucket policy changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0155/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0155/CloudFormation.md new file mode 100644 index 000000000..cf6be7ab1 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0155/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on AWS Config configuration changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0155/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0155/Terraform.md new file mode 100644 index 000000000..cf6be7ab1 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0155/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on AWS Config configuration changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0156/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0156/CloudFormation.md new file mode 100644 index 000000000..53476a4db --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0156/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on security group changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0156/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0156/Terraform.md new file mode 100644 index 000000000..53476a4db --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0156/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on security group changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0157/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0157/CloudFormation.md new file mode 100644 index 000000000..7a6b201ca --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0157/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on network acl changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0157/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0157/Terraform.md new file mode 100644 index 000000000..7a6b201ca --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0157/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on network acl changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0158/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0158/CloudFormation.md new file mode 100644 index 000000000..6baa5b1d2 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0158/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on network gateway changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0158/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0158/Terraform.md new file mode 100644 index 000000000..6baa5b1d2 --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0158/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on network gateway changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0159/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0159/CloudFormation.md new file mode 100644 index 000000000..b7e556d0a --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0159/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on route table changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0159/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0159/Terraform.md new file mode 100644 index 000000000..b7e556d0a --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0159/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on route table changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0160/CloudFormation.md b/avd_docs/aws/cloudwatch/AVD-AWS-0160/CloudFormation.md new file mode 100644 index 000000000..b7e556d0a --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0160/CloudFormation.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on route table changes + + + diff --git a/avd_docs/aws/cloudwatch/AVD-AWS-0160/Terraform.md b/avd_docs/aws/cloudwatch/AVD-AWS-0160/Terraform.md new file mode 100644 index 000000000..b7e556d0a --- /dev/null +++ b/avd_docs/aws/cloudwatch/AVD-AWS-0160/Terraform.md @@ -0,0 +1,5 @@ + +Create an alarm to alert on route table changes + + + diff --git a/avd_docs/aws/codebuild/AVD-AWS-0018/CloudFormation.md b/avd_docs/aws/codebuild/AVD-AWS-0018/CloudFormation.md index 18ef77e22..62177016b 100644 --- a/avd_docs/aws/codebuild/AVD-AWS-0018/CloudFormation.md +++ b/avd_docs/aws/codebuild/AVD-AWS-0018/CloudFormation.md @@ -1,10 +1,7 @@ Enable encryption for CodeBuild project artifacts -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodProject: Type: AWS::CodeBuild::Project @@ -29,4 +26,7 @@ Resources: Packaging: "String" Path: "String" Type: "String" + ``` + + diff --git a/avd_docs/aws/codebuild/AVD-AWS-0018/Terraform.md b/avd_docs/aws/codebuild/AVD-AWS-0018/Terraform.md index f50f7bafe..71dc0d75d 100644 --- a/avd_docs/aws/codebuild/AVD-AWS-0018/Terraform.md +++ b/avd_docs/aws/codebuild/AVD-AWS-0018/Terraform.md @@ -2,39 +2,40 @@ Enable encryption for CodeBuild project artifacts ```hcl -resource "aws_codebuild_project" "good_example" { - // other config - - artifacts { - // other artifacts config - - encryption_disabled = false - } -} - -resource "aws_codebuild_project" "good_example" { - // other config - - artifacts { - // other artifacts config - } -} - -resource "aws_codebuild_project" "codebuild" { - // other config - - secondary_artifacts { - // other artifacts config - - encryption_disabled = false - } - - secondary_artifacts { - // other artifacts config - } -} + resource "aws_codebuild_project" "good_example" { + // other config + + artifacts { + // other artifacts config + + encryption_disabled = false + } + } + + resource "aws_codebuild_project" "good_example" { + // other config + + artifacts { + // other artifacts config + } + } + + resource "aws_codebuild_project" "codebuild" { + // other config + + secondary_artifacts { + // other artifacts config + + encryption_disabled = false + } + + secondary_artifacts { + // other artifacts config + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project#encryption_disabled - \ No newline at end of file + diff --git a/avd_docs/aws/config/AVD-AWS-0019/CloudFormation.md b/avd_docs/aws/config/AVD-AWS-0019/CloudFormation.md index 3375e27ec..542908cf9 100644 --- a/avd_docs/aws/config/AVD-AWS-0019/CloudFormation.md +++ b/avd_docs/aws/config/AVD-AWS-0019/CloudFormation.md @@ -1,10 +1,7 @@ Set the aggregator to cover all regions -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Type: AWS::Config::ConfigurationAggregator @@ -12,4 +9,17 @@ Resources: AccountAggregationSources: - AllAwsRegions: true ConfigurationAggregatorName: "GoodAccountLevelAggregation" + +``` +```yaml--- +Resources: + GoodExample: + Type: AWS::Config::ConfigurationAggregator + Properties: + OrganizationAggregationSource: + AllAwsRegions: true + ConfigurationAggregatorName: "GoodAccountLevelAggregation" + ``` + + diff --git a/avd_docs/aws/config/AVD-AWS-0019/Terraform.md b/avd_docs/aws/config/AVD-AWS-0019/Terraform.md index 20f9e0a7f..a7539df05 100644 --- a/avd_docs/aws/config/AVD-AWS-0019/Terraform.md +++ b/avd_docs/aws/config/AVD-AWS-0019/Terraform.md @@ -2,16 +2,17 @@ Set the aggregator to cover all regions ```hcl -resource "aws_config_configuration_aggregator" "good_example" { - name = "example" - - account_aggregation_source { - account_ids = ["123456789012"] - all_regions = true - } -} + resource "aws_config_configuration_aggregator" "good_example" { + name = "example" + + account_aggregation_source { + account_ids = ["123456789012"] + all_regions = true + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_configuration_aggregator#all_regions - \ No newline at end of file + diff --git a/avd_docs/aws/documentdb/AVD-AWS-0020/CloudFormation.md b/avd_docs/aws/documentdb/AVD-AWS-0020/CloudFormation.md index 4714c8edc..58819786e 100644 --- a/avd_docs/aws/documentdb/AVD-AWS-0020/CloudFormation.md +++ b/avd_docs/aws/documentdb/AVD-AWS-0020/CloudFormation.md @@ -1,10 +1,7 @@ Enable export logs -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Type: "AWS::DocDB::DBCluster" @@ -25,4 +22,7 @@ Resources: DBInstanceClass: "db.r5.large" DBInstanceIdentifier: "sample-cluster-instance-0" PreferredMaintenanceWindow: "sat:06:54-sat:07:24" + ``` + + diff --git a/avd_docs/aws/documentdb/AVD-AWS-0020/Terraform.md b/avd_docs/aws/documentdb/AVD-AWS-0020/Terraform.md index 7cd2a2945..d93f1706e 100644 --- a/avd_docs/aws/documentdb/AVD-AWS-0020/Terraform.md +++ b/avd_docs/aws/documentdb/AVD-AWS-0020/Terraform.md @@ -2,18 +2,19 @@ Enable export logs ```hcl -resource "aws_docdb_cluster" "good_example" { - cluster_identifier = "my-docdb-cluster" - engine = "docdb" - master_username = "foo" - master_password = "mustbeeightchars" - backup_retention_period = 5 - preferred_backup_window = "07:00-09:00" - skip_final_snapshot = true - enabled_cloudwatch_logs_exports = "audit" -} + resource "aws_docdb_cluster" "good_example" { + cluster_identifier = "my-docdb-cluster" + engine = "docdb" + master_username = "foo" + master_password = "mustbeeightchars" + backup_retention_period = 5 + preferred_backup_window = "07:00-09:00" + skip_final_snapshot = true + enabled_cloudwatch_logs_exports = "audit" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#enabled_cloudwatch_logs_exports - \ No newline at end of file + diff --git a/avd_docs/aws/documentdb/AVD-AWS-0021/CloudFormation.md b/avd_docs/aws/documentdb/AVD-AWS-0021/CloudFormation.md index 17c0e8616..921fd35a7 100644 --- a/avd_docs/aws/documentdb/AVD-AWS-0021/CloudFormation.md +++ b/avd_docs/aws/documentdb/AVD-AWS-0021/CloudFormation.md @@ -1,10 +1,7 @@ Enable storage encryption -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Type: "AWS::DocDB::DBCluster" @@ -26,4 +23,7 @@ Resources: DBInstanceClass: "db.r5.large" DBInstanceIdentifier: "sample-cluster-instance-0" PreferredMaintenanceWindow: "sat:06:54-sat:07:24" + ``` + + diff --git a/avd_docs/aws/documentdb/AVD-AWS-0021/Terraform.md b/avd_docs/aws/documentdb/AVD-AWS-0021/Terraform.md index 480799058..71cd4c022 100644 --- a/avd_docs/aws/documentdb/AVD-AWS-0021/Terraform.md +++ b/avd_docs/aws/documentdb/AVD-AWS-0021/Terraform.md @@ -2,18 +2,19 @@ Enable storage encryption ```hcl -resource "aws_docdb_cluster" "good_example" { - cluster_identifier = "my-docdb-cluster" - engine = "docdb" - master_username = "foo" - master_password = "mustbeeightchars" - backup_retention_period = 5 - preferred_backup_window = "07:00-09:00" - skip_final_snapshot = true - storage_encrypted = true -} + resource "aws_docdb_cluster" "good_example" { + cluster_identifier = "my-docdb-cluster" + engine = "docdb" + master_username = "foo" + master_password = "mustbeeightchars" + backup_retention_period = 5 + preferred_backup_window = "07:00-09:00" + skip_final_snapshot = true + storage_encrypted = true + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#storage_encrypted - \ No newline at end of file + diff --git a/avd_docs/aws/documentdb/AVD-AWS-0022/CloudFormation.md b/avd_docs/aws/documentdb/AVD-AWS-0022/CloudFormation.md index 17864b3d2..695177a67 100644 --- a/avd_docs/aws/documentdb/AVD-AWS-0022/CloudFormation.md +++ b/avd_docs/aws/documentdb/AVD-AWS-0022/CloudFormation.md @@ -1,10 +1,7 @@ Enable encryption using customer managed keys -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Type: "AWS::DocDB::DBCluster" @@ -25,4 +22,7 @@ Resources: DBInstanceClass: "db.r5.large" DBInstanceIdentifier: "sample-cluster-instance-0" PreferredMaintenanceWindow: "sat:06:54-sat:07:24" + ``` + + diff --git a/avd_docs/aws/documentdb/AVD-AWS-0022/Terraform.md b/avd_docs/aws/documentdb/AVD-AWS-0022/Terraform.md index 6a8a5a650..301457298 100644 --- a/avd_docs/aws/documentdb/AVD-AWS-0022/Terraform.md +++ b/avd_docs/aws/documentdb/AVD-AWS-0022/Terraform.md @@ -2,22 +2,23 @@ Enable encryption using customer managed keys ```hcl -resource "aws_kms_key" "docdb_encryption" { - enable_key_rotation = true -} - -resource "aws_docdb_cluster" "docdb" { - cluster_identifier = "my-docdb-cluster" - engine = "docdb" - master_username = "foo" - master_password = "mustbeeightchars" - backup_retention_period = 5 - preferred_backup_window = "07:00-09:00" - skip_final_snapshot = true - kms_key_id = aws_kms_key.docdb_encryption.arn -} + resource "aws_kms_key" "docdb_encryption" { + enable_key_rotation = true + } + + resource "aws_docdb_cluster" "docdb" { + cluster_identifier = "my-docdb-cluster" + engine = "docdb" + master_username = "foo" + master_password = "mustbeeightchars" + backup_retention_period = 5 + preferred_backup_window = "07:00-09:00" + skip_final_snapshot = true + kms_key_id = aws_kms_key.docdb_encryption.arn + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#kms_key_id - \ No newline at end of file + diff --git a/avd_docs/aws/dynamodb/AVD-AWS-0023/CloudFormation.md b/avd_docs/aws/dynamodb/AVD-AWS-0023/CloudFormation.md index 465fe0f59..558e673d7 100644 --- a/avd_docs/aws/dynamodb/AVD-AWS-0023/CloudFormation.md +++ b/avd_docs/aws/dynamodb/AVD-AWS-0023/CloudFormation.md @@ -1,10 +1,7 @@ Enable encryption at rest for DAX Cluster -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: daxCluster: Type: AWS::DAX::Cluster @@ -16,4 +13,7 @@ Resources: Description: "DAX cluster created with CloudFormation" SSESpecification: SSEEnabled: true + ``` + + diff --git a/avd_docs/aws/dynamodb/AVD-AWS-0023/Terraform.md b/avd_docs/aws/dynamodb/AVD-AWS-0023/Terraform.md index e17c1f821..23355ed15 100644 --- a/avd_docs/aws/dynamodb/AVD-AWS-0023/Terraform.md +++ b/avd_docs/aws/dynamodb/AVD-AWS-0023/Terraform.md @@ -2,15 +2,16 @@ Enable encryption at rest for DAX Cluster ```hcl -resource "aws_dax_cluster" "good_example" { - // other DAX config - - server_side_encryption { - enabled = true // enabled server side encryption - } -} + resource "aws_dax_cluster" "good_example" { + // other DAX config + + server_side_encryption { + enabled = true // enabled server side encryption + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dax_cluster#server_side_encryption - \ No newline at end of file + diff --git a/avd_docs/aws/dynamodb/AVD-AWS-0024/Terraform.md b/avd_docs/aws/dynamodb/AVD-AWS-0024/Terraform.md index 4dc8dc3f9..9a5811f53 100644 --- a/avd_docs/aws/dynamodb/AVD-AWS-0024/Terraform.md +++ b/avd_docs/aws/dynamodb/AVD-AWS-0024/Terraform.md @@ -2,24 +2,25 @@ Enable point in time recovery ```hcl -resource "aws_dynamodb_table" "good_example" { - name = "example" - hash_key = "TestTableHashKey" - billing_mode = "PAY_PER_REQUEST" - stream_enabled = true - stream_view_type = "NEW_AND_OLD_IMAGES" - - attribute { - name = "TestTableHashKey" - type = "S" - } - - point_in_time_recovery { - enabled = true - } -} + resource "aws_dynamodb_table" "good_example" { + name = "example" + hash_key = "TestTableHashKey" + billing_mode = "PAY_PER_REQUEST" + stream_enabled = true + stream_view_type = "NEW_AND_OLD_IMAGES" + + attribute { + name = "TestTableHashKey" + type = "S" + } + + point_in_time_recovery { + enabled = true + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table#point_in_time_recovery - \ No newline at end of file + diff --git a/avd_docs/aws/dynamodb/AVD-AWS-0025/Terraform.md b/avd_docs/aws/dynamodb/AVD-AWS-0025/Terraform.md index 95c83a6ba..843a790c5 100644 --- a/avd_docs/aws/dynamodb/AVD-AWS-0025/Terraform.md +++ b/avd_docs/aws/dynamodb/AVD-AWS-0025/Terraform.md @@ -2,37 +2,38 @@ Enable server side encryption with a customer managed key ```hcl -resource "aws_kms_key" "dynamo_db_kms" { - enable_key_rotation = true -} - -resource "aws_dynamodb_table" "good_example" { - name = "example" - hash_key = "TestTableHashKey" - billing_mode = "PAY_PER_REQUEST" - stream_enabled = true - stream_view_type = "NEW_AND_OLD_IMAGES" - - attribute { - name = "TestTableHashKey" - type = "S" - } - - replica { - region_name = "us-east-2" - } - - replica { - region_name = "us-west-2" - } - - server_side_encryption { - enabled = true - kms_key_arn = aws_kms_key.dynamo_db_kms.key_id - } -} + resource "aws_kms_key" "dynamo_db_kms" { + enable_key_rotation = true + } + + resource "aws_dynamodb_table" "good_example" { + name = "example" + hash_key = "TestTableHashKey" + billing_mode = "PAY_PER_REQUEST" + stream_enabled = true + stream_view_type = "NEW_AND_OLD_IMAGES" + + attribute { + name = "TestTableHashKey" + type = "S" + } + + replica { + region_name = "us-east-2" + } + + replica { + region_name = "us-west-2" + } + + server_side_encryption { + enabled = true + kms_key_arn = aws_kms_key.dynamo_db_kms.key_id + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table#server_side_encryption - \ No newline at end of file + diff --git a/avd_docs/aws/ec2/AVD-AWS-0008/CloudFormation.md b/avd_docs/aws/ec2/AVD-AWS-0008/CloudFormation.md new file mode 100644 index 000000000..8439a5faf --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0008/CloudFormation.md @@ -0,0 +1,18 @@ + +Turn on encryption for all block devices + +```yaml--- +Resources: + GoodExample: + Properties: + BlockDeviceMappings: + - DeviceName: root + Ebs: + Encrypted: true + ImageId: ami-123456 + InstanceType: t2.small + Type: AWS::AutoScaling::LaunchConfiguration + +``` + + diff --git a/avd_docs/aws/ec2/AVD-AWS-0008/Terraform.md b/avd_docs/aws/ec2/AVD-AWS-0008/Terraform.md new file mode 100644 index 000000000..89f8ee15e --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0008/Terraform.md @@ -0,0 +1,15 @@ + +Turn on encryption for all block devices + +```hcl + resource "aws_launch_configuration" "good_example" { + root_block_device { + encrypted = true + } + } + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#ebs-ephemeral-and-root-block-devices + diff --git a/avd_docs/aws/ec2/AVD-AWS-0009/CloudFormation.md b/avd_docs/aws/ec2/AVD-AWS-0009/CloudFormation.md new file mode 100644 index 000000000..0292fee90 --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0009/CloudFormation.md @@ -0,0 +1,14 @@ + +Set the instance to not be publicly accessible + +```yaml--- +Resources: + GoodExample: + Properties: + ImageId: ami-123456 + InstanceType: t2.small + Type: AWS::AutoScaling::LaunchConfiguration + +``` + + diff --git a/avd_docs/aws/ec2/AVD-AWS-0009/Terraform.md b/avd_docs/aws/ec2/AVD-AWS-0009/Terraform.md new file mode 100644 index 000000000..14eb2802c --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0009/Terraform.md @@ -0,0 +1,15 @@ + +Set the instance to not be publicly accessible + +```hcl + resource "aws_launch_configuration" "good_example" { + associate_public_ip_address = false + } + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#associate_public_ip_address + + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#associate_public_ip_address + diff --git a/avd_docs/aws/ec2/AVD-AWS-0026/CloudFormation.md b/avd_docs/aws/ec2/AVD-AWS-0026/CloudFormation.md new file mode 100644 index 000000000..f0378b74e --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0026/CloudFormation.md @@ -0,0 +1,16 @@ + +Enable encryption of EBS volumes + +```yaml--- +Resources: + GoodExample: + Type: AWS::EC2::Volume + Properties: + Size: 100 + Encrypted: true + KmsKeyId: "alias/volumeEncrypt" + DeletionPolicy: Snapshot + +``` + + diff --git a/avd_docs/aws/ec2/AVD-AWS-0026/Terraform.md b/avd_docs/aws/ec2/AVD-AWS-0026/Terraform.md new file mode 100644 index 000000000..43891b769 --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0026/Terraform.md @@ -0,0 +1,19 @@ + +Enable encryption of EBS volumes + +```hcl + resource "aws_ebs_volume" "good_example" { + availability_zone = "us-west-2a" + size = 40 + + tags = { + Name = "HelloWorld" + } + encrypted = true + } + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted + diff --git a/avd_docs/aws/ec2/AVD-AWS-0027/CloudFormation.md b/avd_docs/aws/ec2/AVD-AWS-0027/CloudFormation.md new file mode 100644 index 000000000..00ad68051 --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0027/CloudFormation.md @@ -0,0 +1,27 @@ + +Enable encryption using customer managed keys + +```yaml--- +Resources: + GoodExample: + Type: AWS::EC2::Volume + Properties: + Size: 100 + Encrypted: true + KmsKeyId: "alias/volumeEncrypt" + DeletionPolicy: Snapshot + +``` +```yaml--- +Resources: + GoodExample: + Type: AWS::EC2::Volume + Properties: + Size: 100 + Encrypted: true + KmsKeyId: !ImportValue "MyStack:Key" + DeletionPolicy: Snapshot + +``` + + diff --git a/avd_docs/aws/ec2/AVD-AWS-0027/Terraform.md b/avd_docs/aws/ec2/AVD-AWS-0027/Terraform.md new file mode 100644 index 000000000..42977ae0e --- /dev/null +++ b/avd_docs/aws/ec2/AVD-AWS-0027/Terraform.md @@ -0,0 +1,24 @@ + +Enable encryption using customer managed keys + +```hcl + resource "aws_kms_key" "ebs_encryption" { + enable_key_rotation = true + } + + resource "aws_ebs_volume" "example" { + availability_zone = "us-west-2a" + size = 40 + + kms_key_id = aws_kms_key.ebs_encryption.arn + + tags = { + Name = "HelloWorld" + } + } + +``` + +#### Remediation Links + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#kms_key_id + diff --git a/avd_docs/aws/ec2/AVD-AWS-0028/Terraform.md b/avd_docs/aws/ec2/AVD-AWS-0028/Terraform.md index 156520523..7b323dc09 100644 --- a/avd_docs/aws/ec2/AVD-AWS-0028/Terraform.md +++ b/avd_docs/aws/ec2/AVD-AWS-0028/Terraform.md @@ -2,15 +2,16 @@ Enable HTTP token requirement for IMDS ```hcl -resource "aws_instance" "good_example" { - ami = "ami-005e54dee72cc1d00" - instance_type = "t2.micro" - metadata_options { - http_tokens = "required" - } -} + resource "aws_instance" "good_example" { + ami = "ami-005e54dee72cc1d00" + instance_type = "t2.micro" + metadata_options { + http_tokens = "required" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options - \ No newline at end of file + diff --git a/avd_docs/aws/ec2/AVD-AWS-0029/CloudFormation.md b/avd_docs/aws/ec2/AVD-AWS-0029/CloudFormation.md index 659c7402a..361b833ef 100644 --- a/avd_docs/aws/ec2/AVD-AWS-0029/CloudFormation.md +++ b/avd_docs/aws/ec2/AVD-AWS-0029/CloudFormation.md @@ -1,10 +1,7 @@ Remove sensitive data from the EC2 instance user-data -```yaml ---- -AWSTemplateFormatVersion: "2010-09-09" -Description: A sample template +```yaml--- Resources: GoodExample: Type: AWS::EC2::Instance @@ -20,4 +17,8 @@ Resources: DeleteOnTermination: "false" VolumeSize: "20" - DeviceName: "/dev/sdk" + + ``` + + diff --git a/avd_docs/aws/ec2/AVD-AWS-0029/Terraform.md b/avd_docs/aws/ec2/AVD-AWS-0029/Terraform.md index 1619f2a08..813649655 100644 --- a/avd_docs/aws/ec2/AVD-AWS-0029/Terraform.md +++ b/avd_docs/aws/ec2/AVD-AWS-0029/Terraform.md @@ -2,22 +2,23 @@ Remove sensitive data from the EC2 instance user-data ```hcl -resource "aws_iam_instance_profile" "good_example" { - // ... -} - -resource "aws_instance" "good_example" { - ami = "ami-12345667" - instance_type = "t2.small" - - iam_instance_profile = aws_iam_instance_profile.good_profile.arn - - user_data = <= 2.99.0 + role_based_access_control_enabled = true + } + +``` +```hcl resource "azurerm_kubernetes_cluster" "aks_cluster" { name = var.name location = var.location @@ -44,9 +50,8 @@ resource "azurerm_kubernetes_cluster" "aks_cluster" { } - ``` #### Remediation Links - https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html#role_based_access_control - \ No newline at end of file + diff --git a/avd_docs/azure/container/AVD-AZU-0043/Terraform.md b/avd_docs/azure/container/AVD-AZU-0043/Terraform.md index 38eba1d52..ffa1276dc 100644 --- a/avd_docs/azure/container/AVD-AZU-0043/Terraform.md +++ b/avd_docs/azure/container/AVD-AZU-0043/Terraform.md @@ -2,13 +2,14 @@ Configure a network policy ```hcl -resource "azurerm_kubernetes_cluster" "good_example" { - network_profile { - network_policy = "calico" - } -} + resource "azurerm_kubernetes_cluster" "good_example" { + network_profile { + network_policy = "calico" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#network_policy - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0018/Terraform.md b/avd_docs/azure/database/AVD-AZU-0018/Terraform.md index a18807965..288e9a40a 100644 --- a/avd_docs/azure/database/AVD-AZU-0018/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0018/Terraform.md @@ -2,20 +2,21 @@ Provide at least one email address for threat alerts ```hcl -resource "azurerm_mssql_server_security_alert_policy" "good_example" { - resource_group_name = azurerm_resource_group.example.name - server_name = azurerm_sql_server.example.name - state = "Enabled" - storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint - storage_account_access_key = azurerm_storage_account.example.primary_access_key - disabled_alerts = [ - "Sql_Injection", - "Data_Exfiltration" - ] - email_addresses = ["db-security@acme.org"] -} + resource "azurerm_mssql_server_security_alert_policy" "good_example" { + resource_group_name = azurerm_resource_group.example.name + server_name = azurerm_sql_server.example.name + state = "Enabled" + storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint + storage_account_access_key = azurerm_storage_account.example.primary_access_key + disabled_alerts = [ + "Sql_Injection", + "Data_Exfiltration" + ] + email_addresses = ["db-security@acme.org"] + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server_security_alert_policy#email_addresses - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0019/Terraform.md b/avd_docs/azure/database/AVD-AZU-0019/Terraform.md index d5715c919..6f264c562 100644 --- a/avd_docs/azure/database/AVD-AZU-0019/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0019/Terraform.md @@ -2,33 +2,36 @@ Enable connection logging ```hcl -resource "azurerm_resource_group" "example" { - name = "example-resources" - location = "West Europe" -} - -resource "azurerm_postgresql_server" "example" { - name = "example-psqlserver" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - - administrator_login = "psqladminun" - administrator_login_password = "H@Sh1CoR3!" - - sku_name = "GP_Gen5_4" - version = "9.6" - storage_mb = 640000 -} - -resource "azurerm_postgresql_configuration" "example" { - name = "log_connections" - resource_group_name = azurerm_resource_group.example.name - server_name = azurerm_postgresql_server.example.name - value = "on" -} + resource "azurerm_resource_group" "example" { + name = "example-resources" + location = "West Europe" + } + + resource "azurerm_postgresql_server" "example" { + name = "example-psqlserver" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + + administrator_login = "psqladminun" + administrator_login_password = "H@Sh1CoR3!" + + sku_name = "GP_Gen5_4" + version = "9.6" + storage_mb = 640000 + } + + resource "azurerm_postgresql_configuration" "example" { + name = "log_connections" + resource_group_name = azurerm_resource_group.example.name + server_name = azurerm_postgresql_server.example.name + value = "on" + } + + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_configuration + - https://docs.microsoft.com/en-us/azure/postgresql/concepts-server-logs#configure-logging - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0020/Terraform.md b/avd_docs/azure/database/AVD-AZU-0020/Terraform.md index bc231c30b..e1c54cd0f 100644 --- a/avd_docs/azure/database/AVD-AZU-0020/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0020/Terraform.md @@ -2,17 +2,20 @@ Enable SSL enforcement ```hcl -resource "azurerm_postgresql_server" "good_example" { - name = "good_example" - - public_network_access_enabled = false - ssl_enforcement_enabled = true - ssl_minimal_tls_version_enforced = "TLS1_2" -} + resource "azurerm_postgresql_server" "good_example" { + name = "good_example" + + public_network_access_enabled = false + ssl_enforcement_enabled = true + ssl_minimal_tls_version_enforced = "TLS1_2" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server#ssl_enforcement_enabled + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server#ssl_enforcement_enabled + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mariadb_server#ssl_enforcement_enabled - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0021/Terraform.md b/avd_docs/azure/database/AVD-AZU-0021/Terraform.md index 774449f70..94895ffa3 100644 --- a/avd_docs/azure/database/AVD-AZU-0021/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0021/Terraform.md @@ -2,32 +2,34 @@ Enable connection throttling logging ```hcl -resource "azurerm_resource_group" "example" { - name = "example-resources" - location = "West Europe" -} - -resource "azurerm_postgresql_server" "example" { - name = "example-psqlserver" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - - administrator_login = "psqladminun" - administrator_login_password = "H@Sh1CoR3!" - - sku_name = "GP_Gen5_4" - version = "9.6" - storage_mb = 640000 -} - -resource "azurerm_postgresql_configuration" "example" { - name = "connection_throttling" - resource_group_name = azurerm_resource_group.example.name - server_name = azurerm_postgresql_server.example.name - value = "on" -} + resource "azurerm_resource_group" "example" { + name = "example-resources" + location = "West Europe" + } + + resource "azurerm_postgresql_server" "example" { + name = "example-psqlserver" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + + administrator_login = "psqladminun" + administrator_login_password = "H@Sh1CoR3!" + + sku_name = "GP_Gen5_4" + version = "9.6" + storage_mb = 640000 + } + + resource "azurerm_postgresql_configuration" "example" { + name = "connection_throttling" + resource_group_name = azurerm_resource_group.example.name + server_name = azurerm_postgresql_server.example.name + value = "on" + } + + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_configuration - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0022/Terraform.md b/avd_docs/azure/database/AVD-AZU-0022/Terraform.md index e083caff8..217393a60 100644 --- a/avd_docs/azure/database/AVD-AZU-0022/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0022/Terraform.md @@ -2,17 +2,20 @@ Disable public access to database when not required ```hcl -resource "azurerm_postgresql_server" "good_example" { - name = "bad_example" - - public_network_access_enabled = false - ssl_enforcement_enabled = false - ssl_minimal_tls_version_enforced = "TLS1_2" -} + resource "azurerm_postgresql_server" "good_example" { + name = "bad_example" + + public_network_access_enabled = false + ssl_enforcement_enabled = false + ssl_minimal_tls_version_enforced = "TLS1_2" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server#public_network_access_enabled + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server#public_network_access_enabled + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mariadb_server#public_network_access_enabled - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0023/Terraform.md b/avd_docs/azure/database/AVD-AZU-0023/Terraform.md index ac3acf67c..b42927755 100644 --- a/avd_docs/azure/database/AVD-AZU-0023/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0023/Terraform.md @@ -2,18 +2,19 @@ Enable email to subscription owners ```hcl -resource "azurerm_mssql_server_security_alert_policy" "good_example" { - resource_group_name = azurerm_resource_group.example.name - server_name = azurerm_sql_server.example.name - state = "Enabled" - storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint - storage_account_access_key = azurerm_storage_account.example.primary_access_key - disabled_alerts = [] - - email_account_admins = true -} + resource "azurerm_mssql_server_security_alert_policy" "good_example" { + resource_group_name = azurerm_resource_group.example.name + server_name = azurerm_sql_server.example.name + state = "Enabled" + storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint + storage_account_access_key = azurerm_storage_account.example.primary_access_key + disabled_alerts = [] + + email_account_admins = true + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server_security_alert_policy#email_account_admins - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0024/Terraform.md b/avd_docs/azure/database/AVD-AZU-0024/Terraform.md index 44e788da2..d9aa58a04 100644 --- a/avd_docs/azure/database/AVD-AZU-0024/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0024/Terraform.md @@ -2,32 +2,34 @@ Enable checkpoint logging ```hcl -resource "azurerm_resource_group" "example" { - name = "example-resources" - location = "West Europe" -} - -resource "azurerm_postgresql_server" "example" { - name = "example-psqlserver" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - - administrator_login = "psqladminun" - administrator_login_password = "H@Sh1CoR3!" - - sku_name = "GP_Gen5_4" - version = "9.6" - storage_mb = 640000 -} - -resource "azurerm_postgresql_configuration" "example" { - name = "log_checkpoints" - resource_group_name = azurerm_resource_group.example.name - server_name = azurerm_postgresql_server.example.name - value = "on" -} + resource "azurerm_resource_group" "example" { + name = "example-resources" + location = "West Europe" + } + + resource "azurerm_postgresql_server" "example" { + name = "example-psqlserver" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + + administrator_login = "psqladminun" + administrator_login_password = "H@Sh1CoR3!" + + sku_name = "GP_Gen5_4" + version = "9.6" + storage_mb = 640000 + } + + resource "azurerm_postgresql_configuration" "example" { + name = "log_checkpoints" + resource_group_name = azurerm_resource_group.example.name + server_name = azurerm_postgresql_server.example.name + value = "on" + } + + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_configuration - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0025/Terraform.md b/avd_docs/azure/database/AVD-AZU-0025/Terraform.md index 45af45523..4693d398a 100644 --- a/avd_docs/azure/database/AVD-AZU-0025/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0025/Terraform.md @@ -2,23 +2,25 @@ Set retention periods of database auditing to greater than 90 days ```hcl -resource "azurerm_mssql_database_extended_auditing_policy" "good_example" { - database_id = azurerm_mssql_database.example.id - storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint - storage_account_access_key = azurerm_storage_account.example.primary_access_key - storage_account_access_key_is_secondary = false -} - -resource "azurerm_mssql_database_extended_auditing_policy" "good_example" { - database_id = azurerm_mssql_database.example.id - storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint - storage_account_access_key = azurerm_storage_account.example.primary_access_key - storage_account_access_key_is_secondary = false - retention_in_days = 90 -} + resource "azurerm_mssql_database_extended_auditing_policy" "good_example" { + database_id = azurerm_mssql_database.example.id + storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint + storage_account_access_key = azurerm_storage_account.example.primary_access_key + storage_account_access_key_is_secondary = false + } + + resource "azurerm_mssql_database_extended_auditing_policy" "good_example" { + database_id = azurerm_mssql_database.example.id + storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint + storage_account_access_key = azurerm_storage_account.example.primary_access_key + storage_account_access_key_is_secondary = false + retention_in_days = 90 + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_database_extended_auditing_policy + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server#retention_in_days - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0026/Terraform.md b/avd_docs/azure/database/AVD-AZU-0026/Terraform.md index 1ebb93cf2..86ba9c297 100644 --- a/avd_docs/azure/database/AVD-AZU-0026/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0026/Terraform.md @@ -2,27 +2,30 @@ Use the most modern TLS policies available ```hcl -resource "azurerm_mssql_server" "good_example" { - name = "mssqlserver" - resource_group_name = azurerm_resource_group.example.name - location = azurerm_resource_group.example.location - version = "12.0" - administrator_login = "missadministrator" - administrator_login_password = "thisIsKat11" - minimum_tls_version = "1.2" -} - -resource "azurerm_postgresql_server" "good_example" { - name = "bad_example" - - public_network_access_enabled = true - ssl_enforcement_enabled = false - ssl_minimal_tls_version_enforced = "TLS1_2" -} + resource "azurerm_mssql_server" "good_example" { + name = "mssqlserver" + resource_group_name = azurerm_resource_group.example.name + location = azurerm_resource_group.example.location + version = "12.0" + administrator_login = "missadministrator" + administrator_login_password = "thisIsKat11" + minimum_tls_version = "1.2" + } + + resource "azurerm_postgresql_server" "good_example" { + name = "bad_example" + + public_network_access_enabled = true + ssl_enforcement_enabled = false + ssl_minimal_tls_version_enforced = "TLS1_2" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server#minimum_tls_version + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server#ssl_minimal_tls_version_enforced + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server#ssl_minimal_tls_version_enforced - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0027/Terraform.md b/avd_docs/azure/database/AVD-AZU-0027/Terraform.md index 3e23d3747..81b530905 100644 --- a/avd_docs/azure/database/AVD-AZU-0027/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0027/Terraform.md @@ -2,23 +2,24 @@ Enable auditing on Azure SQL databases ```hcl -resource "azurerm_sql_server" "good_example" { - name = "mssqlserver" - resource_group_name = azurerm_resource_group.example.name - location = azurerm_resource_group.example.location - version = "12.0" - administrator_login = "mradministrator" - administrator_login_password = "tfsecRocks" - - extended_auditing_policy { - storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint - storage_account_access_key = azurerm_storage_account.example.primary_access_key - storage_account_access_key_is_secondary = true - retention_in_days = 6 - } -} + resource "azurerm_sql_server" "good_example" { + name = "mssqlserver" + resource_group_name = azurerm_resource_group.example.name + location = azurerm_resource_group.example.location + version = "12.0" + administrator_login = "mradministrator" + administrator_login_password = "tfsecRocks" + + extended_auditing_policy { + storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint + storage_account_access_key = azurerm_storage_account.example.primary_access_key + storage_account_access_key_is_secondary = true + retention_in_days = 6 + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/sql_server#extended_auditing_policy - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0028/Terraform.md b/avd_docs/azure/database/AVD-AZU-0028/Terraform.md index aa813b808..0f07baae0 100644 --- a/avd_docs/azure/database/AVD-AZU-0028/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0028/Terraform.md @@ -2,17 +2,18 @@ Use all provided threat alerts ```hcl -resource "azurerm_mssql_server_security_alert_policy" "good_example" { - resource_group_name = azurerm_resource_group.example.name - server_name = azurerm_sql_server.example.name - state = "Enabled" - storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint - storage_account_access_key = azurerm_storage_account.example.primary_access_key - disabled_alerts = [] - retention_days = 20 -} + resource "azurerm_mssql_server_security_alert_policy" "good_example" { + resource_group_name = azurerm_resource_group.example.name + server_name = azurerm_sql_server.example.name + state = "Enabled" + storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint + storage_account_access_key = azurerm_storage_account.example.primary_access_key + disabled_alerts = [] + retention_days = 20 + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_server_security_alert_policy#disabled_alerts - \ No newline at end of file + diff --git a/avd_docs/azure/database/AVD-AZU-0029/Terraform.md b/avd_docs/azure/database/AVD-AZU-0029/Terraform.md index 6c0eba8f7..11e31700b 100644 --- a/avd_docs/azure/database/AVD-AZU-0029/Terraform.md +++ b/avd_docs/azure/database/AVD-AZU-0029/Terraform.md @@ -2,15 +2,16 @@ Don't use wide ip ranges for the sql firewall ```hcl -resource "azurerm_sql_firewall_rule" "good_example" { - name = "good_rule" - resource_group_name = azurerm_resource_group.example.name - server_name = azurerm_sql_server.example.name - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" -} + resource "azurerm_sql_firewall_rule" "good_example" { + name = "good_rule" + resource_group_name = azurerm_resource_group.example.name + server_name = azurerm_sql_server.example.name + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/sql_firewall_rule#end_ip_address - \ No newline at end of file + diff --git a/avd_docs/azure/datafactory/AVD-AZU-0035/Terraform.md b/avd_docs/azure/datafactory/AVD-AZU-0035/Terraform.md index a1d4d0dcc..f249dcaca 100644 --- a/avd_docs/azure/datafactory/AVD-AZU-0035/Terraform.md +++ b/avd_docs/azure/datafactory/AVD-AZU-0035/Terraform.md @@ -2,14 +2,15 @@ Set public access to disabled for Data Factory ```hcl -resource "azurerm_data_factory" "good_example" { - name = "example" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - public_network_enabled = false -} + resource "azurerm_data_factory" "good_example" { + name = "example" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + public_network_enabled = false + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/data_factory#public_network_enabled - \ No newline at end of file + diff --git a/avd_docs/azure/datalake/AVD-AZU-0036/Terraform.md b/avd_docs/azure/datalake/AVD-AZU-0036/Terraform.md index 3bd1a98bb..d25432cd8 100644 --- a/avd_docs/azure/datalake/AVD-AZU-0036/Terraform.md +++ b/avd_docs/azure/datalake/AVD-AZU-0036/Terraform.md @@ -2,11 +2,11 @@ Enable encryption of data lake storage ```hcl -resource "azurerm_data_lake_store" "good_example" { - encryption_state = "Enabled" -} + resource "azurerm_data_lake_store" "good_example" { + encryption_state = "Enabled" + } ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/data_lake_store - \ No newline at end of file + diff --git a/avd_docs/azure/keyvault/AVD-AZU-0013/Terraform.md b/avd_docs/azure/keyvault/AVD-AZU-0013/Terraform.md index 654b49105..eadbee784 100644 --- a/avd_docs/azure/keyvault/AVD-AZU-0013/Terraform.md +++ b/avd_docs/azure/keyvault/AVD-AZU-0013/Terraform.md @@ -2,20 +2,21 @@ Set a network ACL for the key vault ```hcl -resource "azurerm_key_vault" "good_example" { - name = "examplekeyvault" - location = azurerm_resource_group.good_example.location - enabled_for_disk_encryption = true - soft_delete_retention_days = 7 - purge_protection_enabled = false - - network_acls { - bypass = "AzureServices" - default_action = "Deny" - } -} + resource "azurerm_key_vault" "good_example" { + name = "examplekeyvault" + location = azurerm_resource_group.good_example.location + enabled_for_disk_encryption = true + soft_delete_retention_days = 7 + purge_protection_enabled = false + + network_acls { + bypass = "AzureServices" + default_action = "Deny" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#network_acls - \ No newline at end of file + diff --git a/avd_docs/azure/keyvault/AVD-AZU-0014/Terraform.md b/avd_docs/azure/keyvault/AVD-AZU-0014/Terraform.md index d188dff20..e4cda441a 100644 --- a/avd_docs/azure/keyvault/AVD-AZU-0014/Terraform.md +++ b/avd_docs/azure/keyvault/AVD-AZU-0014/Terraform.md @@ -2,24 +2,25 @@ Set an expiration date on the vault key ```hcl -resource "azurerm_key_vault_key" "good_example" { - name = "generated-certificate" - key_vault_id = azurerm_key_vault.example.id - key_type = "RSA" - key_size = 2048 - expiration_date = "1982-12-31T00:00:00Z" - - key_opts = [ - "decrypt", - "encrypt", - "sign", - "unwrapKey", - "verify", - "wrapKey", - ] -} + resource "azurerm_key_vault_key" "good_example" { + name = "generated-certificate" + key_vault_id = azurerm_key_vault.example.id + key_type = "RSA" + key_size = 2048 + expiration_date = "1982-12-31T00:00:00Z" + + key_opts = [ + "decrypt", + "encrypt", + "sign", + "unwrapKey", + "verify", + "wrapKey", + ] + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#expiration_date - \ No newline at end of file + diff --git a/avd_docs/azure/keyvault/AVD-AZU-0015/Terraform.md b/avd_docs/azure/keyvault/AVD-AZU-0015/Terraform.md index a300b3a0f..b8896eb1b 100644 --- a/avd_docs/azure/keyvault/AVD-AZU-0015/Terraform.md +++ b/avd_docs/azure/keyvault/AVD-AZU-0015/Terraform.md @@ -2,14 +2,15 @@ Provide content type for secrets to aid interpretation on retrieval ```hcl -resource "azurerm_key_vault_secret" "good_example" { - name = "secret-sauce" - value = "szechuan" - key_vault_id = azurerm_key_vault.example.id - content_type = "password" -} + resource "azurerm_key_vault_secret" "good_example" { + name = "secret-sauce" + value = "szechuan" + key_vault_id = azurerm_key_vault.example.id + content_type = "password" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#content_type - \ No newline at end of file + diff --git a/avd_docs/azure/keyvault/AVD-AZU-0016/Terraform.md b/avd_docs/azure/keyvault/AVD-AZU-0016/Terraform.md index 2a4464af8..3ab531c1c 100644 --- a/avd_docs/azure/keyvault/AVD-AZU-0016/Terraform.md +++ b/avd_docs/azure/keyvault/AVD-AZU-0016/Terraform.md @@ -2,15 +2,16 @@ Enable purge protection for key vaults ```hcl -resource "azurerm_key_vault" "good_example" { - name = "examplekeyvault" - location = azurerm_resource_group.good_example.location - enabled_for_disk_encryption = true - soft_delete_retention_days = 7 - purge_protection_enabled = true -} + resource "azurerm_key_vault" "good_example" { + name = "examplekeyvault" + location = azurerm_resource_group.good_example.location + enabled_for_disk_encryption = true + soft_delete_retention_days = 7 + purge_protection_enabled = true + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#purge_protection_enabled - \ No newline at end of file + diff --git a/avd_docs/azure/keyvault/AVD-AZU-0017/Terraform.md b/avd_docs/azure/keyvault/AVD-AZU-0017/Terraform.md index d38d0cf36..e5b1f8e64 100644 --- a/avd_docs/azure/keyvault/AVD-AZU-0017/Terraform.md +++ b/avd_docs/azure/keyvault/AVD-AZU-0017/Terraform.md @@ -2,14 +2,37 @@ Set an expiry for secrets ```hcl -resource "azurerm_key_vault_secret" "good_example" { - name = "secret-sauce" - value = "szechuan" - key_vault_id = azurerm_key_vault.example.id - expiration_date = "1982-12-31T00:00:00Z" + resource "azurerm_key_vault_secret" "good_example" { + name = "secret-sauce" + value = "szechuan" + key_vault_id = azurerm_key_vault.example.id + expiration_date = "1982-12-31T00:00:00Z" + } + +``` +```hcl +resource "azuread_application" "myapp" { + display_name = "MyAzureAD App" + + group_membership_claims = ["ApplicationGroup"] + prevent_duplicate_names = true + +} + +resource "azuread_application_password" "myapp" { + application_object_id = azuread_application.myapp.object_id +} + +resource "azurerm_key_vault_secret" "myapp_pass" { + name = "myapp-oauth" + value = azuread_application_password.myapp.value + key_vault_id = azurerm_key_vault.cluster_key_vault.id + expiration_date = azuread_application_password.myapp.end_date + content_type = "Password" } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret#expiration_date - \ No newline at end of file + diff --git a/avd_docs/azure/monitor/AVD-AZU-0031/Terraform.md b/avd_docs/azure/monitor/AVD-AZU-0031/Terraform.md index 6584e3272..ed69ea036 100644 --- a/avd_docs/azure/monitor/AVD-AZU-0031/Terraform.md +++ b/avd_docs/azure/monitor/AVD-AZU-0031/Terraform.md @@ -2,16 +2,17 @@ Set a retention period that will allow for delayed investigation ```hcl -resource "azurerm_monitor_log_profile" "good_example" { - name = "good_example" - - retention_policy { - enabled = true - days = 365 - } -} + resource "azurerm_monitor_log_profile" "good_example" { + name = "good_example" + + retention_policy { + enabled = true + days = 365 + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_log_profile#retention_policy - \ No newline at end of file + diff --git a/avd_docs/azure/monitor/AVD-AZU-0032/Terraform.md b/avd_docs/azure/monitor/AVD-AZU-0032/Terraform.md index 3749d45cf..13445bda0 100644 --- a/avd_docs/azure/monitor/AVD-AZU-0032/Terraform.md +++ b/avd_docs/azure/monitor/AVD-AZU-0032/Terraform.md @@ -2,89 +2,91 @@ Enable capture for all locations ```hcl -resource "azurerm_monitor_log_profile" "bad_example" { - name = "bad_example" - - categories = [] - - locations = [ - "eastus", - "eastus2", - "southcentralus", - "westus2", - "westus3", - "australiaeast", - "southeastasia", - "northeurope", - "swedencentral", - "uksouth", - "westeurope", - "centralus", - "northcentralus", - "westus", - "southafricanorth", - "centralindia", - "eastasia", - "japaneast", - "jioindiawest", - "koreacentral", - "canadacentral", - "francecentral", - "germanywestcentral", - "norwayeast", - "switzerlandnorth", - "uaenorth", - "brazilsouth", - "centralusstage", - "eastusstage", - "eastus2stage", - "northcentralusstage", - "southcentralusstage", - "westusstage", - "westus2stage", - "asia", - "asiapacific", - "australia", - "brazil", - "canada", - "europe", - "global", - "india", - "japan", - "uk", - "unitedstates", - "eastasiastage", - "southeastasiastage", - "centraluseuap", - "eastus2euap", - "westcentralus", - "southafricawest", - "australiacentral", - "australiacentral2", - "australiasoutheast", - "japanwest", - "jioindiacentral", - "koreasouth", - "southindia", - "westindia", - "canadaeast", - "francesouth", - "germanynorth", - "norwaywest", - "swedensouth", - "switzerlandwest", - "ukwest", - "uaecentral", - "brazilsoutheast", - ] - - retention_policy { - enabled = true - days = 7 - } -} + resource "azurerm_monitor_log_profile" "bad_example" { + name = "bad_example" + + categories = [] + + locations = [ + "eastus", + "eastus2", + "southcentralus", + "westus2", + "westus3", + "australiaeast", + "southeastasia", + "northeurope", + "swedencentral", + "uksouth", + "westeurope", + "centralus", + "northcentralus", + "westus", + "southafricanorth", + "centralindia", + "eastasia", + "japaneast", + "jioindiawest", + "koreacentral", + "canadacentral", + "francecentral", + "germanywestcentral", + "norwayeast", + "switzerlandnorth", + "uaenorth", + "brazilsouth", + "centralusstage", + "eastusstage", + "eastus2stage", + "northcentralusstage", + "southcentralusstage", + "westusstage", + "westus2stage", + "asia", + "asiapacific", + "australia", + "brazil", + "canada", + "europe", + "global", + "india", + "japan", + "uk", + "unitedstates", + "eastasiastage", + "southeastasiastage", + "centraluseuap", + "eastus2euap", + "westcentralus", + "southafricawest", + "australiacentral", + "australiacentral2", + "australiasoutheast", + "japanwest", + "jioindiacentral", + "koreasouth", + "southindia", + "westindia", + "canadaeast", + "francesouth", + "germanynorth", + "norwaywest", + "swedensouth", + "switzerlandwest", + "ukwest", + "uaecentral", + "brazilsoutheast", + ] + + retention_policy { + enabled = true + days = 7 + } + } + + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_log_profile#locations - \ No newline at end of file + diff --git a/avd_docs/azure/monitor/AVD-AZU-0033/Terraform.md b/avd_docs/azure/monitor/AVD-AZU-0033/Terraform.md index ec207d4ef..be85029a5 100644 --- a/avd_docs/azure/monitor/AVD-AZU-0033/Terraform.md +++ b/avd_docs/azure/monitor/AVD-AZU-0033/Terraform.md @@ -2,22 +2,23 @@ Configure log profile to capture all activities ```hcl -resource "azurerm_monitor_log_profile" "good_example" { - name = "good_example" - - categories = [ - "Action", - "Delete", - "Write", - ] - - retention_policy { - enabled = true - days = 365 - } -} + resource "azurerm_monitor_log_profile" "good_example" { + name = "good_example" + + categories = [ + "Action", + "Delete", + "Write", + ] + + retention_policy { + enabled = true + days = 365 + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_log_profile#categories - \ No newline at end of file + diff --git a/avd_docs/azure/network/AVD-AZU-0047/Terraform.md b/avd_docs/azure/network/AVD-AZU-0047/Terraform.md index f313d07b6..9d0018d9a 100644 --- a/avd_docs/azure/network/AVD-AZU-0047/Terraform.md +++ b/avd_docs/azure/network/AVD-AZU-0047/Terraform.md @@ -2,13 +2,23 @@ Set a more restrictive cidr range ```hcl -resource "azurerm_network_security_rule" "good_example" { - direction = "Inbound" - destination_address_prefix = "10.0.0.0/16" - access = "Allow" + resource "azurerm_network_security_rule" "good_example" { + direction = "Inbound" + destination_address_prefix = "10.0.0.0/16" + access = "Allow" + } +``` +```hcl +resource "azurerm_network_security_rule" "allow_lb_prober" { + direction = "Inbound" + access = "Allow" + protocol = "Tcp" # Probes are always TCP + source_port_range = "*" + destination_port_ranges = "443" + source_address_prefix = "168.63.129.16" // single public IP (Azure well known) } ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule - \ No newline at end of file + diff --git a/avd_docs/azure/network/AVD-AZU-0048/Terraform.md b/avd_docs/azure/network/AVD-AZU-0048/Terraform.md index de53fdea3..0012503fc 100644 --- a/avd_docs/azure/network/AVD-AZU-0048/Terraform.md +++ b/avd_docs/azure/network/AVD-AZU-0048/Terraform.md @@ -2,32 +2,34 @@ Block RDP port from internet ```hcl -resource "azurerm_network_security_rule" "good_example" { - name = "good_example_security_rule" - direction = "Inbound" - access = "Allow" - protocol = "TCP" - source_port_range = "*" - destination_port_range = ["3389"] - source_address_prefix = "4.53.160.75" - destination_address_prefix = "*" -} - -resource "azurerm_network_security_group" "example" { - name = "tf-appsecuritygroup" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - - security_rule { - source_port_range = "any" - destination_port_range = ["3389"] - source_address_prefix = "4.53.160.75" - destination_address_prefix = "*" - } -} + resource "azurerm_network_security_rule" "good_example" { + name = "good_example_security_rule" + direction = "Inbound" + access = "Allow" + protocol = "TCP" + source_port_range = "*" + destination_port_ranges = ["3389"] + source_address_prefix = "4.53.160.75" + destination_address_prefix = "*" + } + + resource "azurerm_network_security_group" "example" { + name = "tf-appsecuritygroup" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + + security_rule { + source_port_range = "any" + destination_port_ranges = ["3389"] + source_address_prefix = "4.53.160.75" + destination_address_prefix = "*" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/network_security_group#security_rule + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule#source_port_ranges - \ No newline at end of file + diff --git a/avd_docs/azure/network/AVD-AZU-0049/Terraform.md b/avd_docs/azure/network/AVD-AZU-0049/Terraform.md index 4b318c91f..f8b5db66b 100644 --- a/avd_docs/azure/network/AVD-AZU-0049/Terraform.md +++ b/avd_docs/azure/network/AVD-AZU-0049/Terraform.md @@ -3,20 +3,21 @@ Ensure flow log retention is turned on with an expiry of >90 days ```hcl resource "azurerm_network_watcher_flow_log" "good_watcher" { - network_watcher_name = "good_watcher" - resource_group_name = "resource-group" - - network_security_group_id = azurerm_network_security_group.test.id - storage_account_id = azurerm_storage_account.test.id - enabled = true - - retention_policy { - enabled = true - days = 90 - } + network_watcher_name = "good_watcher" + resource_group_name = "resource-group" + + network_security_group_id = azurerm_network_security_group.test.id + storage_account_id = azurerm_storage_account.test.id + enabled = true + + retention_policy { + enabled = true + days = 90 + } } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_watcher_flow_log#retention_policy - \ No newline at end of file + diff --git a/avd_docs/azure/network/AVD-AZU-0050/Terraform.md b/avd_docs/azure/network/AVD-AZU-0050/Terraform.md index 9ad9e1a11..65c256ad5 100644 --- a/avd_docs/azure/network/AVD-AZU-0050/Terraform.md +++ b/avd_docs/azure/network/AVD-AZU-0050/Terraform.md @@ -2,32 +2,21 @@ Block port 22 access from the internet ```hcl -resource "azurerm_network_security_rule" "good_example" { - name = "good_example_security_rule" - direction = "Inbound" - access = "Allow" - protocol = "TCP" - source_port_range = "*" - destination_port_range = ["22"] - source_address_prefix = "82.102.23.23" - destination_address_prefix = "*" -} - -resource "azurerm_network_security_group" "example" { - name = "tf-appsecuritygroup" - location = azurerm_resource_group.example.location - resource_group_name = azurerm_resource_group.example.name - - security_rule { - source_port_range = "any" - destination_port_range = ["22"] - source_address_prefix = "82.102.23.23" - destination_address_prefix = "*" - } -} + resource "azurerm_network_security_rule" "good_example" { + name = "good_example_security_rule" + direction = "Inbound" + access = "Allow" + protocol = "TCP" + source_port_range = "*" + destination_port_range = "22" + source_address_prefix = "82.102.23.23" + destination_address_prefix = "*" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/network_security_group#security_rule + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule#source_port_ranges - \ No newline at end of file + diff --git a/avd_docs/azure/network/AVD-AZU-0051/Terraform.md b/avd_docs/azure/network/AVD-AZU-0051/Terraform.md index 0cb252b46..1781c9ce6 100644 --- a/avd_docs/azure/network/AVD-AZU-0051/Terraform.md +++ b/avd_docs/azure/network/AVD-AZU-0051/Terraform.md @@ -2,13 +2,13 @@ Set a more restrictive cidr range ```hcl -resource "azurerm_network_security_rule" "good_example" { - direction = "Outbound" - destination_address_prefix = "10.0.0.0/16" - access = "Allow" -} + resource "azurerm_network_security_rule" "good_example" { + direction = "Outbound" + destination_address_prefix = "10.0.0.0/16" + access = "Allow" + } ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule - \ No newline at end of file + diff --git a/avd_docs/azure/securitycenter/AVD-AZU-0044/Terraform.md b/avd_docs/azure/securitycenter/AVD-AZU-0044/Terraform.md index c142a28cb..ddd8c460a 100644 --- a/avd_docs/azure/securitycenter/AVD-AZU-0044/Terraform.md +++ b/avd_docs/azure/securitycenter/AVD-AZU-0044/Terraform.md @@ -2,15 +2,16 @@ Set alert notifications to be on ```hcl -resource "azurerm_security_center_contact" "good_example" { - email = "good_example@example.com" - phone = "+1-555-555-5555" - - alert_notifications = true - alerts_to_admins = true -} + resource "azurerm_security_center_contact" "good_example" { + email = "good_example@example.com" + phone = "+1-555-555-5555" + + alert_notifications = true + alerts_to_admins = true + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/security_center_contact#alert_notifications - \ No newline at end of file + diff --git a/avd_docs/azure/securitycenter/AVD-AZU-0045/Terraform.md b/avd_docs/azure/securitycenter/AVD-AZU-0045/Terraform.md index 6441b5efc..4db565e94 100644 --- a/avd_docs/azure/securitycenter/AVD-AZU-0045/Terraform.md +++ b/avd_docs/azure/securitycenter/AVD-AZU-0045/Terraform.md @@ -2,12 +2,13 @@ Enable standard subscription tier to benefit from Azure Defender ```hcl -resource "azurerm_security_center_subscription_pricing" "good_example" { - tier = "Standard" - resource_type = "VirtualMachines" -} + resource "azurerm_security_center_subscription_pricing" "good_example" { + tier = "Standard" + resource_type = "VirtualMachines" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/security_center_subscription_pricing#tier - \ No newline at end of file + diff --git a/avd_docs/azure/securitycenter/AVD-AZU-0046/Terraform.md b/avd_docs/azure/securitycenter/AVD-AZU-0046/Terraform.md index f427134bb..af31d46ae 100644 --- a/avd_docs/azure/securitycenter/AVD-AZU-0046/Terraform.md +++ b/avd_docs/azure/securitycenter/AVD-AZU-0046/Terraform.md @@ -2,15 +2,16 @@ Set a telephone number for security center contact ```hcl -resource "azurerm_security_center_contact" "good_example" { - email = "good_contact@example.com" - phone = "+1-555-555-5555" - - alert_notifications = true - alerts_to_admins = true -} + resource "azurerm_security_center_contact" "good_example" { + email = "good_contact@example.com" + phone = "+1-555-555-5555" + + alert_notifications = true + alerts_to_admins = true + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/security_center_contact#phone - \ No newline at end of file + diff --git a/avd_docs/azure/storage/AVD-AZU-0007/Terraform.md b/avd_docs/azure/storage/AVD-AZU-0007/Terraform.md index 7b6252ad5..57a503085 100644 --- a/avd_docs/azure/storage/AVD-AZU-0007/Terraform.md +++ b/avd_docs/azure/storage/AVD-AZU-0007/Terraform.md @@ -2,16 +2,13 @@ Disable public access to storage containers ```hcl -resource "azure_storage_container" "good_example" { - name = "terraform-container-storage" - container_access_type = "blob" - - properties = { - "publicAccess" = "off" - } -} + resource "azurerm_storage_container" "good_example" { + name = "terraform-container-storage" + container_access_type = "private" + } + ``` #### Remediation Links - https://www.terraform.io/docs/providers/azure/r/storage_container.html#properties - \ No newline at end of file + diff --git a/avd_docs/azure/storage/AVD-AZU-0008/Terraform.md b/avd_docs/azure/storage/AVD-AZU-0008/Terraform.md index 8f2b6991a..e94b9e755 100644 --- a/avd_docs/azure/storage/AVD-AZU-0008/Terraform.md +++ b/avd_docs/azure/storage/AVD-AZU-0008/Terraform.md @@ -2,16 +2,17 @@ Only allow secure connection for transferring data into storage accounts ```hcl -resource "azurerm_storage_account" "good_example" { - name = "storageaccountname" - resource_group_name = azurerm_resource_group.example.name - location = azurerm_resource_group.example.location - account_tier = "Standard" - account_replication_type = "GRS" - enable_https_traffic_only = true -} + resource "azurerm_storage_account" "good_example" { + name = "storageaccountname" + resource_group_name = azurerm_resource_group.example.name + location = azurerm_resource_group.example.location + account_tier = "Standard" + account_replication_type = "GRS" + enable_https_traffic_only = true + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#enable_https_traffic_only - \ No newline at end of file + diff --git a/avd_docs/azure/storage/AVD-AZU-0009/Terraform.md b/avd_docs/azure/storage/AVD-AZU-0009/Terraform.md index dc4dba488..a0170a992 100644 --- a/avd_docs/azure/storage/AVD-AZU-0009/Terraform.md +++ b/avd_docs/azure/storage/AVD-AZU-0009/Terraform.md @@ -2,24 +2,25 @@ Enable logging for Queue Services ```hcl -resource "azurerm_storage_account" "good_example" { - name = "example" - resource_group_name = data.azurerm_resource_group.example.name - location = data.azurerm_resource_group.example.location - account_tier = "Standard" - account_replication_type = "GRS" - queue_properties { - logging { - delete = true - read = true - write = true - version = "1.0" - retention_policy_days = 10 - } - } -} + resource "azurerm_storage_account" "good_example" { + name = "example" + resource_group_name = data.azurerm_resource_group.example.name + location = data.azurerm_resource_group.example.location + account_tier = "Standard" + account_replication_type = "GRS" + queue_properties { + logging { + delete = true + read = true + write = true + version = "1.0" + retention_policy_days = 10 + } + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#logging - \ No newline at end of file + diff --git a/avd_docs/azure/storage/AVD-AZU-0010/Terraform.md b/avd_docs/azure/storage/AVD-AZU-0010/Terraform.md index 3cb65447b..cf440d43c 100644 --- a/avd_docs/azure/storage/AVD-AZU-0010/Terraform.md +++ b/avd_docs/azure/storage/AVD-AZU-0010/Terraform.md @@ -2,38 +2,40 @@ Allow Trusted Microsoft Services to bypass ```hcl -resource "azurerm_storage_account" "good_example" { - name = "storageaccountname" - resource_group_name = azurerm_resource_group.example.name - - location = azurerm_resource_group.example.location - account_tier = "Standard" - account_replication_type = "LRS" - - network_rules { - default_action = "Deny" - ip_rules = ["100.0.0.1"] - virtual_network_subnet_ids = [azurerm_subnet.example.id] - bypass = ["Metrics", "AzureServices"] - } - - tags = { - environment = "staging" - } -} - -resource "azurerm_storage_account_network_rules" "test" { - resource_group_name = azurerm_resource_group.test.name - storage_account_name = azurerm_storage_account.test.name - - default_action = "Allow" - ip_rules = ["127.0.0.1"] - virtual_network_subnet_ids = [azurerm_subnet.test.id] - bypass = ["Metrics", "AzureServices"] -} + resource "azurerm_storage_account" "good_example" { + name = "storageaccountname" + resource_group_name = azurerm_resource_group.example.name + + location = azurerm_resource_group.example.location + account_tier = "Standard" + account_replication_type = "LRS" + + network_rules { + default_action = "Deny" + ip_rules = ["100.0.0.1"] + virtual_network_subnet_ids = [azurerm_subnet.example.id] + bypass = ["Metrics", "AzureServices"] + } + + tags = { + environment = "staging" + } + } + + resource "azurerm_storage_account_network_rules" "test" { + resource_group_name = azurerm_resource_group.test.name + storage_account_name = azurerm_storage_account.test.name + + default_action = "Allow" + ip_rules = ["127.0.0.1"] + virtual_network_subnet_ids = [azurerm_subnet.test.id] + bypass = ["Metrics", "AzureServices"] + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#bypass + - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#bypass - \ No newline at end of file + diff --git a/avd_docs/azure/storage/AVD-AZU-0011/Terraform.md b/avd_docs/azure/storage/AVD-AZU-0011/Terraform.md index 26a0dbff3..5f4780943 100644 --- a/avd_docs/azure/storage/AVD-AZU-0011/Terraform.md +++ b/avd_docs/azure/storage/AVD-AZU-0011/Terraform.md @@ -2,14 +2,15 @@ Use a more recent TLS/SSL policy for the load balancer ```hcl -resource "azurerm_storage_account" "good_example" { - name = "storageaccountname" - resource_group_name = azurerm_resource_group.example.name - location = azurerm_resource_group.example.location - min_tls_version = "TLS1_2" -} + resource "azurerm_storage_account" "good_example" { + name = "storageaccountname" + resource_group_name = azurerm_resource_group.example.name + location = azurerm_resource_group.example.location + min_tls_version = "TLS1_2" + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#min_tls_version - \ No newline at end of file + diff --git a/avd_docs/azure/storage/AVD-AZU-0012/Terraform.md b/avd_docs/azure/storage/AVD-AZU-0012/Terraform.md index 024b977ae..b6ed570dc 100644 --- a/avd_docs/azure/storage/AVD-AZU-0012/Terraform.md +++ b/avd_docs/azure/storage/AVD-AZU-0012/Terraform.md @@ -2,15 +2,16 @@ Set network rules to deny ```hcl -resource "azurerm_storage_account_network_rules" "good_example" { - - default_action = "Deny" - ip_rules = ["127.0.0.1"] - virtual_network_subnet_ids = [azurerm_subnet.test.id] - bypass = ["Metrics"] -} + resource "azurerm_storage_account_network_rules" "good_example" { + + default_action = "Deny" + ip_rules = ["127.0.0.1"] + virtual_network_subnet_ids = [azurerm_subnet.test.id] + bypass = ["Metrics"] + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules#default_action - \ No newline at end of file + diff --git a/avd_docs/azure/synapse/AVD-AZU-0034/Terraform.md b/avd_docs/azure/synapse/AVD-AZU-0034/Terraform.md index 64dd36bb0..ca7bcf0cf 100644 --- a/avd_docs/azure/synapse/AVD-AZU-0034/Terraform.md +++ b/avd_docs/azure/synapse/AVD-AZU-0034/Terraform.md @@ -2,26 +2,27 @@ Set manage virtual network to enabled ```hcl -resource "azurerm_synapse_workspace" "good_example" { - name = "example" - resource_group_name = azurerm_resource_group.example.name - location = azurerm_resource_group.example.location - storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id - sql_administrator_login = "sqladminuser" - sql_administrator_login_password = "H@Sh1CoR3!" - managed_virtual_network_enabled = true - aad_admin { - login = "AzureAD Admin" - object_id = "00000000-0000-0000-0000-000000000000" - tenant_id = "00000000-0000-0000-0000-000000000000" - } - - tags = { - Env = "production" - } -} + resource "azurerm_synapse_workspace" "good_example" { + name = "example" + resource_group_name = azurerm_resource_group.example.name + location = azurerm_resource_group.example.location + storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id + sql_administrator_login = "sqladminuser" + sql_administrator_login_password = "H@Sh1CoR3!" + managed_virtual_network_enabled = true + aad_admin { + login = "AzureAD Admin" + object_id = "00000000-0000-0000-0000-000000000000" + tenant_id = "00000000-0000-0000-0000-000000000000" + } + + tags = { + Env = "production" + } + } + ``` #### Remediation Links - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/synapse_workspace#managed_virtual_network_enabled - \ No newline at end of file + diff --git a/avd_docs/cloudstack/compute/AVD-CLDSTK-0001/Terraform.md b/avd_docs/cloudstack/compute/AVD-CLDSTK-0001/Terraform.md index daf6a3820..5cec9f625 100644 --- a/avd_docs/cloudstack/compute/AVD-CLDSTK-0001/Terraform.md +++ b/avd_docs/cloudstack/compute/AVD-CLDSTK-0001/Terraform.md @@ -2,18 +2,30 @@ Don't use sensitive data in the user data section ```hcl -resource "cloudstack_instance" "web" { - name = "server-1" - service_offering = "small" - network_id = "6eb22f91-7454-4107-89f4-36afcdf33021" - template = "CentOS 6.5" - zone = "zone-1" - user_data = <