Skip to content

Create infra.ts #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Create infra.ts #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 61 additions & 0 deletions cdk-test/infra.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
// file: lib/insecure-stack.ts
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';

import * as s3 from 'aws-cdk-lib/aws-s3';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as rds from 'aws-cdk-lib/aws-rds';

export class InsecureStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

/* 1️⃣ Public S3 bucket, all safeguards disabled */
const bucket = new s3.Bucket(this, 'PublicBucket', {
bucketName: 'my-public-bucket-001',
publicReadAccess: true,
blockPublicAccess: s3.BlockPublicAccess.NONE, // 🔴 no block-public-access settings
versioned: false,
removalPolicy: cdk.RemovalPolicy.DESTROY,
autoDeleteObjects: true,
});
Comment on lines +15 to +22

Check failure

Code scanning / Infrabase AI

S3 Buckets Must Block Public Access Error

In cdk-test/infra.ts (lines ~14-21), a new S3 bucket is created with publicReadAccess set to true, blockPublicAccess disabled, versioning off, and no server-side encryption. This exposes all objects to anonymous users and stores data unencrypted at rest. Recommendation: Remove publicReadAccess or scope it to a narrow set of principals. Enable BlockPublicAccess.BLOCK_ALL (or at minimum block public ACLs and policies), set the ACL to private, and configure server-side encryption (e.g. bucketEncryption: s3.BucketEncryption.S3_MANAGED). Enable versioning to protect against accidental deletes if appropriate.

/* 2️⃣ VPC with a security group open to the world */
const vpc = new ec2.Vpc(this, 'MyVpc', {
subnetConfiguration: [
{ name: 'public', subnetType: ec2.SubnetType.PUBLIC },
Comment on lines +23 to +27

Check notice

Code scanning / Infrabase AI

No raw resources when possible Note

In cdk-test/infra.ts (lines ~23-27), a VPC is created directly using ec2.Vpc. Your organization maintains an internal VPC module (git::https://github.com/diggerhq/common-modules//vpc) that enforces standard tagging, flow logging, and subnet layouts. Recommendation: Use the internal VPC module to ensure consistency: e.g., new ModuleVPC(this, 'MyVpc', { source: 'git::https://github.com/diggerhq/common-modules//vpc', /* module inputs */ });
],
maxAzs: 2,
Comment on lines +26 to +29

Check warning

Code scanning / Infrabase AI

No raw resources when possible Warning

In cdk-test/infra.ts (lines ~36-40), the IAM role "OverPermissiveRole" is assigned the AWS-managed AdministratorAccess policy, granting broad privileges across all services and resources. Recommendation: Follow the principle of least privilege. Define a custom IAM policy or attach only the specific AWS-managed policies that grant the minimal set of actions and resources required by your workload.
});

const sg = new ec2.SecurityGroup(this, 'OpenSg', {
vpc,
Comment on lines +31 to +33

Check failure

Code scanning / Infrabase AI

No raw resources when possible Error

In cdk-test/infra.ts (lines ~29-33), the security group "OpenSg" allows all inbound IPv4 traffic on all ports (0.0.0.0/0). This effectively exposes any resources in the VPC to the entire Internet. Recommendation: Restrict ingress rules to only the required ports and trusted CIDR ranges. For example, replace ec2.Peer.anyIpv4() and ec2.Port.allTraffic() with specific Port.tcp(portNumber) and your organization’s IP ranges.
description: 'Allow all inbound traffic',
allowAllOutbound: true,
});
sg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.allTraffic(), 'Wide-open SG'); // 🔴 0.0.0.0/0 ALL

/* 3️⃣ Wild-card IAM permissions */
const role = new iam.Role(this, 'OverPermissiveRole', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
description: 'Wild-card role for demo',
Comment on lines +36 to +42

Check failure

Code scanning / Infrabase AI

S3 Buckets Must Block Public Access Error

In cdk-test/infra.ts (lines ~43-50), an Amazon RDS instance is created with publiclyAccessible set to true, storageEncrypted disabled, and removalPolicy DESTROY. The database is exposed to the Internet and data at rest is unencrypted. Recommendation: Set publiclyAccessible to false unless absolutely required. Enable storageEncrypted: true and specify a KMS key if you need customer-managed encryption keys. Consider setting removalPolicy to RETAIN or enabling deletionProtection in production environments.
});
role.addManagedPolicy(
iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'), // 🔴 *
);

/* 4️⃣ Public, unencrypted RDS instance */
new rds.DatabaseInstance(this, 'InsecureDb', {
engine: rds.DatabaseInstanceEngine.postgres({
Comment on lines +20 to +50

Check notice

Code scanning / Infrabase AI

No raw resources when possible Note

In cdk-test/infra.ts (lines ~20 and ~50), both the S3 bucket and the RDS instance use removalPolicy: DESTROY. This configuration causes permanent data loss upon stack deletion. Recommendation: In non-development environments, use RemovalPolicy.RETAIN or enable snapshot/deletionProtection options to prevent accidental data loss.
version: rds.PostgresEngineVersion.VER_15,
}),
vpc,
publiclyAccessible: true, // 🔴 internet-facing DB
storageEncrypted: false, // 🔴 no encryption at rest
allocatedStorage: 20,
credentials: rds.Credentials.fromGeneratedSecret('postgres'),
removalPolicy: cdk.RemovalPolicy.DESTROY,
});
}
}