Skip to content

Commit 13c1b69

Browse files
author
IA Automator
committed
initial commit
0 parents  commit 13c1b69

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+1129
-0
lines changed

‎.config/.checkov.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
download-external-modules: False
2+
evaluate-variables: true
3+
directory:
4+
- ./
5+
framework:
6+
- terraform
7+
skip-check:
8+
- CKV2_GCP*
9+
- CKV_AZURE*
10+
- CKV2_AZURE*
11+
- CKV_TF_1 # default to Terraform registry instead of Git
12+
summary-position: bottom
13+
output: 'cli'
14+
compact: True
15+
quiet: True

‎.config/.mdlrc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Ignoring the following rules
2+
# MD007 Unordered list indentation
3+
# MD013 Line length
4+
# MD029 Ordered list item prefix
5+
rules "~MD007", "~MD013", "~MD029"

‎.config/.terraform-docs.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
formatter: markdown
2+
header-from: .header.md
3+
settings:
4+
anchor: true
5+
color: true
6+
default: true
7+
escape: true
8+
html: true
9+
indent: 2
10+
required: true
11+
sensitive: true
12+
type: true
13+
14+
sort:
15+
enabled: true
16+
by: required
17+
18+
output:
19+
file: README.md
20+
mode: replace

‎.config/.tflint.hcl‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/module-inspection.md
2+
# borrowed & modified indefinitely from https://github.com/ksatirli/building-infrastructure-you-can-mostly-trust/blob/main/.tflint.hcl
3+
4+
plugin "aws" {
5+
enabled = true
6+
version = "0.22.1"
7+
source = "github.com/terraform-linters/tflint-ruleset-aws"
8+
}
9+
10+
config {
11+
module = true
12+
force = false
13+
}
14+
15+
rule "terraform_required_providers" {
16+
enabled = true
17+
}
18+
19+
rule "terraform_required_version" {
20+
enabled = true
21+
}
22+
23+
rule "terraform_naming_convention" {
24+
enabled = true
25+
format = "snake_case"
26+
}
27+
28+
rule "terraform_typed_variables" {
29+
enabled = true
30+
}
31+
32+
rule "terraform_unused_declarations" {
33+
enabled = true
34+
}
35+
36+
rule "terraform_comment_syntax" {
37+
enabled = true
38+
}
39+
40+
rule "terraform_deprecated_index" {
41+
enabled = true
42+
}
43+
44+
rule "terraform_deprecated_interpolation" {
45+
enabled = true
46+
}
47+
48+
rule "terraform_documented_outputs" {
49+
enabled = true
50+
}
51+
52+
rule "terraform_documented_variables" {
53+
enabled = true
54+
}
55+
56+
rule "terraform_module_pinned_source" {
57+
enabled = true
58+
}
59+
60+
rule "terraform_standard_module_structure" {
61+
enabled = true
62+
}
63+
64+
rule "terraform_workspace_remote" {
65+
enabled = true
66+
}

‎.config/.tfsec.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"minimum_severity": "MEDIUM"
3+
}

‎.config/.tfsec/launch_configuration_imdsv2_tfchecks.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS002",
5+
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
6+
"impact": "Instance metadata service can be interacted with freely",
7+
"resolution": "Enable HTTP token requirement for IMDS",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_configuration"
13+
],
14+
"severity": "CRITICAL",
15+
"matchSpec": {
16+
"action": "isPresent",
17+
"name": "metadata_options",
18+
"subMatch": {
19+
"action": "and",
20+
"predicateMatchSpec": [
21+
{
22+
"action": "equals",
23+
"name": "http_tokens",
24+
"value": "required"
25+
26+
}
27+
]
28+
}
29+
},
30+
31+
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
32+
"relatedLinks": [
33+
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
34+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata-options",
35+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
36+
]
37+
}
38+
]
39+
}

‎.config/.tfsec/launch_template_imdsv2_tfchecks.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS001",
5+
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
6+
"impact": "Instance metadata service can be interacted with freely",
7+
"resolution": "Enable HTTP token requirement for IMDS",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_template"
13+
],
14+
"severity": "CRITICAL",
15+
"matchSpec": {
16+
"action": "isPresent",
17+
"name": "metadata_options",
18+
"subMatch": {
19+
"action": "and",
20+
"predicateMatchSpec": [
21+
{
22+
"action": "equals",
23+
"name": "http_tokens",
24+
"value": "required"
25+
26+
}
27+
]
28+
}
29+
},
30+
31+
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
32+
"relatedLinks": [
33+
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
34+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#metadata-options",
35+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
36+
]
37+
}
38+
]
39+
}

‎.config/.tfsec/no_launch_config_tfchecks.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS003",
5+
"description": "Use `aws_launch_template` over `aws_launch_configuration",
6+
"impact": "Launch configurations are not capable of versions",
7+
"resolution": "Convert resource type and attributes to `aws_launch_template`",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_configuration"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "image_id"
18+
},
19+
20+
"errorMessage": "should be changed to `aws_launch_template` since the functionality is the same but templates can be versioned.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template",
23+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
24+
]
25+
}
26+
]
27+
}

‎.config/.tfsec/sg_no_embedded_egress_rules_tfchecks.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS005",
5+
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
6+
"impact": "Embedded security group rules can cause issues during configuration updates.",
7+
"resolution": "Move `egress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_security_group"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "egress"
18+
},
19+
20+
"errorMessage": "`egress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
23+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
24+
]
25+
}
26+
]
27+
}

‎.config/.tfsec/sg_no_embedded_ingress_rules_tfchecks.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS004",
5+
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
6+
"impact": "Embedded security group rules can cause issues during configuration updates.",
7+
"resolution": "Move `ingress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_security_group"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "ingress"
18+
},
19+
20+
"errorMessage": "`ingress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
23+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
24+
]
25+
}
26+
]
27+
}

0 commit comments

Comments
 (0)