[CORE-438 CORE-439] added test examples #41
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
igorkotof
commented
Nov 3, 2022
•
igorkotof
commented
- locals are not used when the values are 1:1
- added tests for mostly all common causes
![bridgecrew[bot]](https://avatars.githubusercontent.com/in/52968?s=60&v=4){kind=small}
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_2
How to Fix
resource "aws_security_group" "example" {
...
ingress {
from_port = 3389
to_port = 3389
protocol = "tcp"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = ["10.0.0.1/32"]
}
}Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.#Rationale
Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.2
- PCI-DSS V3.2.1 1.2.1, 1.3
- FEDRAMP (MODERATE) AC-4, CM-2, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| @@ -21,7 +40,6 @@ module "vpc" { | |||
| resource "aws_security_group" "default_permissive" { | |||
| name = "${var.env}-default-permissive" | |||
| vpc_id = module.vpc.vpc_id | |||
| description = "Managed by Terraform" | |||
|
|
|||
There was a problem hiding this comment.
Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_51
How to Fix
resource "aws_network_interface" "test" {
subnet_id = "aws_subnet.public_a.id"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_instance" "test" {
ami = "data.aws_ami.ubuntu.id"
instance_type = "t3.micro"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_security_group" "ok_sg" {
ingress {
description = "TLS from VPC"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = 0.0.0.0/0
}
}
Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_2
How to Fix
resource "aws_security_group" "example" {
...
ingress {
from_port = 3389
to_port = 3389
protocol = "tcp"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = ["10.0.0.1/32"]
}
}Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.#Rationale
Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.2
- PCI-DSS V3.2.1 1.2.1, 1.3
- FEDRAMP (MODERATE) AC-4, CM-2, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS security groups do not allow ingress from 0.0.0.0/0 to port 80
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_67
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_51
How to Fix
resource "aws_network_interface" "test" {
subnet_id = "aws_subnet.public_a.id"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_instance" "test" {
ami = "data.aws_ami.ubuntu.id"
instance_type = "t3.micro"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_security_group" "ok_sg" {
ingress {
description = "TLS from VPC"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = 0.0.0.0/0
}
}
Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.| @@ -22,7 +33,6 @@ module "vpc" { | |||
| resource "aws_security_group" "default_permissive" { | |||
| name = "${var.env}-default-permissive" | |||
| vpc_id = module.vpc.vpc_id | |||
| description = "Managed by Terraform" | |||
|
|
|||
There was a problem hiding this comment.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_2
How to Fix
resource "aws_security_group" "example" {
...
ingress {
from_port = 3389
to_port = 3389
protocol = "tcp"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = ["10.0.0.1/32"]
}
}Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.#Rationale
Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.2
- PCI-DSS V3.2.1 1.2.1, 1.3
- FEDRAMP (MODERATE) AC-4, CM-2, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| @@ -21,7 +40,6 @@ module "vpc" { | |||
| resource "aws_security_group" "default_permissive" { | |||
| name = "${var.env}-default-permissive" | |||
| vpc_id = module.vpc.vpc_id | |||
| description = "Managed by Terraform" | |||
|
|
|||
There was a problem hiding this comment.
Ensure AWS security groups do not allow ingress from 0.0.0.0/0 to port 80
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_67
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS Security Group does not allow all traffic on SSH port 22
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_1
Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.1
- PCI-DSS V3.2.1 1.2.1, 1.3, 2.2.2
- FEDRAMP (MODERATE) AC-4, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS Security Group does not allow all traffic on SSH port 22
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_1
Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.1
- PCI-DSS V3.2.1 1.2.1, 1.3, 2.2.2
- FEDRAMP (MODERATE) AC-4, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS security groups do not allow ingress from 0.0.0.0/0 to port 80
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_67
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_2
How to Fix
resource "aws_security_group" "example" {
...
ingress {
from_port = 3389
to_port = 3389
protocol = "tcp"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = ["10.0.0.1/32"]
}
}Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.#Rationale
Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.2
- PCI-DSS V3.2.1 1.2.1, 1.3
- FEDRAMP (MODERATE) AC-4, CM-2, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| @@ -21,7 +40,6 @@ module "vpc" { | |||
| resource "aws_security_group" "default_permissive" { | |||
| name = "${var.env}-default-permissive" | |||
| vpc_id = module.vpc.vpc_id | |||
| description = "Managed by Terraform" | |||
|
|
|||
There was a problem hiding this comment.
Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_51
How to Fix
resource "aws_network_interface" "test" {
subnet_id = "aws_subnet.public_a.id"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_instance" "test" {
ami = "data.aws_ami.ubuntu.id"
instance_type = "t3.micro"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_security_group" "ok_sg" {
ingress {
description = "TLS from VPC"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = 0.0.0.0/0
}
}
Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_2
How to Fix
resource "aws_security_group" "example" {
...
ingress {
from_port = 3389
to_port = 3389
protocol = "tcp"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = ["10.0.0.1/32"]
}
}Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.#Rationale
Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.2
- PCI-DSS V3.2.1 1.2.1, 1.3
- FEDRAMP (MODERATE) AC-4, CM-2, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS security groups do not allow ingress from 0.0.0.0/0 to port 80
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_67
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_51
How to Fix
resource "aws_network_interface" "test" {
subnet_id = "aws_subnet.public_a.id"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_instance" "test" {
ami = "data.aws_ami.ubuntu.id"
instance_type = "t3.micro"
security_groups = [aws_security_group.ok_sg.id]
}
resource "aws_security_group" "ok_sg" {
ingress {
description = "TLS from VPC"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = 0.0.0.0/0
}
}
Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.| @@ -22,7 +33,6 @@ module "vpc" { | |||
| resource "aws_security_group" "default_permissive" { | |||
| name = "${var.env}-default-permissive" | |||
| vpc_id = module.vpc.vpc_id | |||
| description = "Managed by Terraform" | |||
|
|
|||
There was a problem hiding this comment.
Ensure Security Groups do not allow ingress from 0.0.0.0/0 to port 3389
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_2
How to Fix
resource "aws_security_group" "example" {
...
ingress {
from_port = 3389
to_port = 3389
protocol = "tcp"
- cidr_blocks = ["0.0.0.0/0"]
+ cidr_blocks = ["10.0.0.1/32"]
}
}Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.#Rationale
Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.
Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.2
- PCI-DSS V3.2.1 1.2.1, 1.3
- FEDRAMP (MODERATE) AC-4, CM-2, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| @@ -21,7 +40,6 @@ module "vpc" { | |||
| resource "aws_security_group" "default_permissive" { | |||
| name = "${var.env}-default-permissive" | |||
| vpc_id = module.vpc.vpc_id | |||
| description = "Managed by Terraform" | |||
|
|
|||
There was a problem hiding this comment.
Ensure AWS security groups do not allow ingress from 0.0.0.0/0 to port 80
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_67
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS Security Group does not allow all traffic on SSH port 22
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_1
Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.1
- PCI-DSS V3.2.1 1.2.1, 1.3, 2.2.2
- FEDRAMP (MODERATE) AC-4, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS Security Group does not allow all traffic on SSH port 22
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_1
Description
Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.Benchmarks
- SOC2 CC6.3.3
- PCI-DSS V3.2 2
- HIPAA 164.312(E)(1)
- NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
- ISO27001 A.10.1.1
- CIS AWS V1.2 4.1
- PCI-DSS V3.2.1 1.2.1, 1.3, 2.2.2
- FEDRAMP (MODERATE) AC-4, SC-7, SC-7(3)
- CIS AWS V1.3 5.2
| manage_default_network_acl = true | ||
| default_network_acl_name = "${var.env}-${var.namespace}" | ||
| } | ||
| resource "aws_security_group" "default_permissive" { |
There was a problem hiding this comment.
Ensure AWS security groups do not allow ingress from 0.0.0.0/0 to port 80
Resource: aws_security_group.default_permissive | ID: BC_AWS_NETWORKING_67
AutomationD
approved these changes
Nov 3, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.