storytold/terraform-aws-observability-accelerator
2
0
Fork 0
mirror of https://github.com/storytold/terraform-aws-observability-accelerator.git synced 2026-10-17 00:23:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

removed .tfsec folder

Browse Source
This commit is contained in:
Vara Bonthu
2022-08-11 12:53:33 +01:00
committed by Rodrigue Koffi
parent 09ef0d6c17
commit e00db6cb56
5 changed files with 0 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.tfsec/launch_configuration_imdsv2_tfchecks.json
-39
View File
@@ -1,39 +0,0 @@
{
"checks": [
{
"code": "CUS002",
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
"impact": "Instance metadata service can be interacted with freely",
"resolution": "Enable HTTP token requirement for IMDS",
"requiredTypes": [
"resource"
],
"requiredLabels": [
"aws_launch_configuration"
],
"severity": "CRITICAL",
"matchSpec": {
"action": "isPresent",
"name": "metadata_options",
"subMatch": {
"action": "and",
"predicateMatchSpec": [
{
"action": "equals",
"name": "http_tokens",
"value": "required"
}
]
}
},
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
"relatedLinks": [
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata-options",
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
]
}
]
}
.tfsec/launch_template_imdsv2_tfchecks.json
-39
View File
@@ -1,39 +0,0 @@
{
"checks": [
{
"code": "CUS001",
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
"impact": "Instance metadata service can be interacted with freely",
"resolution": "Enable HTTP token requirement for IMDS",
"requiredTypes": [
"resource"
],
"requiredLabels": [
"aws_launch_template"
],
"severity": "CRITICAL",
"matchSpec": {
"action": "isPresent",
"name": "metadata_options",
"subMatch": {
"action": "and",
"predicateMatchSpec": [
{
"action": "equals",
"name": "http_tokens",
"value": "required"
}
]
}
},
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
"relatedLinks": [
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#metadata-options",
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
]
}
]
}
.tfsec/no_launch_config_tfchecks.json
-27
View File
@@ -1,27 +0,0 @@
{
"checks": [
{
"code": "CUS003",
"description": "Use `aws_launch_template` over `aws_launch_configuration",
"impact": "Launch configurations are not capable of versions",
"resolution": "Convert resource type and attributes to `aws_launch_template`",
"requiredTypes": [
"resource"
],
"requiredLabels": [
"aws_launch_configuration"
],
"severity": "MEDIUM",
"matchSpec": {
"action": "notPresent",
"name": "image_id"
},
"errorMessage": "should be changed to `aws_launch_template` since the functionality is the same but templates can be versioned.",
"relatedLinks": [
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template",
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
]
}
]
}
.tfsec/sg_no_embedded_egress_rules_tfchecks.json
-27
View File
@@ -1,27 +0,0 @@
{
"checks": [
{
"code": "CUS005",
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
"impact": "Embedded security group rules can cause issues during configuration updates.",
"resolution": "Move `egress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
"requiredTypes": [
"resource"
],
"requiredLabels": [
"aws_security_group"
],
"severity": "MEDIUM",
"matchSpec": {
"action": "notPresent",
"name": "egress"
},
"errorMessage": "`egress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
"relatedLinks": [
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
]
}
]
}
.tfsec/sg_no_embedded_ingress_rules_tfchecks.json
-27
View File
@@ -1,27 +0,0 @@
{
"checks": [
{
"code": "CUS004",
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
"impact": "Embedded security group rules can cause issues during configuration updates.",
"resolution": "Move `ingress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
"requiredTypes": [
"resource"
],
"requiredLabels": [
"aws_security_group"
],
"severity": "MEDIUM",
"matchSpec": {
"action": "notPresent",
"name": "ingress"
},
"errorMessage": "`ingress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
"relatedLinks": [
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
]
}
]
}