-
Notifications
You must be signed in to change notification settings - Fork 6
Checkov files #20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Checkov files #20
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| provider "aws" { | ||
| region = "us-east-1" | ||
| } | ||
|
|
||
| resource "aws_s3_bucket" "bad_bucket" { | ||
| bucket = "my-insecure-bucket" | ||
| acl = "public-read" | ||
| } | ||
|
Comment on lines
+5
to
+8
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Public-read ACL creates a world-readable bucket – lock it down. The - acl = "public-read" + acl = "private" + +# Enable versioning to guard against accidental deletes + versioning { + enabled = true + } + +# Default encryption at rest (SSE-KMS) + server_side_encryption_configuration { + rule { + apply_server_side_encryption_by_default { + sse_algorithm = "aws:kms" + } + } + } Add a separate Public Access Block resource to guarantee nothing re-opens the bucket: +resource "aws_s3_bucket_public_access_block" "bad_bucket_pab" { + bucket = aws_s3_bucket.bad_bucket.id + + block_public_acls = true + ignore_public_acls = true + block_public_policy = true + restrict_public_buckets = true +} 📝 Committable suggestion
Suggested change
resource "aws_s3_bucket" "bad_bucket" {
bucket = "my-insecure-bucket"
acl = "public-read"
}
resource "aws_s3_bucket" "bad_bucket" {
bucket = "my-insecure-bucket"
acl = "private"
# Enable versioning to guard against accidental deletes
versioning {
enabled = true
}
# Default encryption at rest (SSE-KMS)
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
}
}
}
}
resource "aws_s3_bucket_public_access_block" "bad_bucket_pab" {
bucket = aws_s3_bucket.bad_bucket.id
block_public_acls = true
ignore_public_acls = true
block_public_policy = true
restrict_public_buckets = true
}
🧰 Tools🪛 Checkov (3.2.334)[MEDIUM] 5-8: Ensure that an S3 bucket has a lifecycle configuration (CKV2_AWS_61) [HIGH] 5-8: S3 Bucket has an ACL defined which allows public READ access. (CKV_AWS_20) 🤖 Prompt for AI Agents |
||
|
|
||
| resource "aws_security_group" "bad_sg" { | ||
| name = "open-sg" | ||
| description = "Security group with open ingress" | ||
| ingress { | ||
| from_port = 22 | ||
| to_port = 22 | ||
| protocol = "tcp" | ||
| cidr_blocks = ["0.0.0.0/0"] | ||
| } | ||
|
Comment on lines
+10
to
+18
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. SSH open to the world (0.0.0.0/0) – huge attack surface. Unrestricted port 22 access invites automated scanning and brute-force attacks. Limit the source CIDR to a known bastion IP range or, better, drop public SSH and use SSM Session Manager. - cidr_blocks = ["0.0.0.0/0"] + # Example: restrict to corporate office IP range + cidr_blocks = ["203.0.113.0/24"] 📝 Committable suggestion
Suggested change
resource "aws_security_group" "bad_sg" {
name = "open-sg"
description = "Security group with open ingress"
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
resource "aws_security_group" "bad_sg" {
name = "open-sg"
description = "Security group with open ingress"
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
# Example: restrict to corporate office IP range
cidr_blocks = ["203.0.113.0/24"]
}
}
🤖 Prompt for AI Agents |
||
| egress { | ||
| from_port = 0 | ||
| to_port = 0 | ||
| protocol = "-1" | ||
| cidr_blocks = ["0.0.0.0/0"] | ||
| } | ||
| } | ||
|
|
||