From e00db6cb56f45032ac9a6e4500903d30bf3ab5a1 Mon Sep 17 00:00:00 2001 From: Vara Bonthu Date: Thu, 11 Aug 2022 12:53:33 +0100 Subject: [PATCH] removed .tfsec folder --- .../launch_configuration_imdsv2_tfchecks.json | 39 ------------------- .tfsec/launch_template_imdsv2_tfchecks.json | 39 ------------------- .tfsec/no_launch_config_tfchecks.json | 27 ------------- .../sg_no_embedded_egress_rules_tfchecks.json | 27 ------------- ...sg_no_embedded_ingress_rules_tfchecks.json | 27 ------------- 5 files changed, 159 deletions(-) delete mode 100644 .tfsec/launch_configuration_imdsv2_tfchecks.json delete mode 100644 .tfsec/launch_template_imdsv2_tfchecks.json delete mode 100644 .tfsec/no_launch_config_tfchecks.json delete mode 100644 .tfsec/sg_no_embedded_egress_rules_tfchecks.json delete mode 100644 .tfsec/sg_no_embedded_ingress_rules_tfchecks.json diff --git a/.tfsec/launch_configuration_imdsv2_tfchecks.json b/.tfsec/launch_configuration_imdsv2_tfchecks.json deleted file mode 100644 index 308ef01..0000000 --- a/.tfsec/launch_configuration_imdsv2_tfchecks.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "checks": [ - { - "code": "CUS002", - "description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template", - "impact": "Instance metadata service can be interacted with freely", - "resolution": "Enable HTTP token requirement for IMDS", - "requiredTypes": [ - "resource" - ], - "requiredLabels": [ - "aws_launch_configuration" - ], - "severity": "CRITICAL", - "matchSpec": { - "action": "isPresent", - "name": "metadata_options", - "subMatch": { - "action": "and", - "predicateMatchSpec": [ - { - "action": "equals", - "name": "http_tokens", - "value": "required" - - } - ] - } - }, - - "errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.", - "relatedLinks": [ - "https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2", - "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata-options", - "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service" - ] - } - ] -} diff --git a/.tfsec/launch_template_imdsv2_tfchecks.json b/.tfsec/launch_template_imdsv2_tfchecks.json deleted file mode 100644 index e1f1aa7..0000000 --- a/.tfsec/launch_template_imdsv2_tfchecks.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "checks": [ - { - "code": "CUS001", - "description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template", - "impact": "Instance metadata service can be interacted with freely", - "resolution": "Enable HTTP token requirement for IMDS", - "requiredTypes": [ - "resource" - ], - "requiredLabels": [ - "aws_launch_template" - ], - "severity": "CRITICAL", - "matchSpec": { - "action": "isPresent", - "name": "metadata_options", - "subMatch": { - "action": "and", - "predicateMatchSpec": [ - { - "action": "equals", - "name": "http_tokens", - "value": "required" - - } - ] - } - }, - - "errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.", - "relatedLinks": [ - "https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2", - "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#metadata-options", - "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service" - ] - } - ] -} diff --git a/.tfsec/no_launch_config_tfchecks.json b/.tfsec/no_launch_config_tfchecks.json deleted file mode 100644 index 89b6328..0000000 --- a/.tfsec/no_launch_config_tfchecks.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "checks": [ - { - "code": "CUS003", - "description": "Use `aws_launch_template` over `aws_launch_configuration", - "impact": "Launch configurations are not capable of versions", - "resolution": "Convert resource type and attributes to `aws_launch_template`", - "requiredTypes": [ - "resource" - ], - "requiredLabels": [ - "aws_launch_configuration" - ], - "severity": "MEDIUM", - "matchSpec": { - "action": "notPresent", - "name": "image_id" - }, - - "errorMessage": "should be changed to `aws_launch_template` since the functionality is the same but templates can be versioned.", - "relatedLinks": [ - "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template", - "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service" - ] - } - ] -} diff --git a/.tfsec/sg_no_embedded_egress_rules_tfchecks.json b/.tfsec/sg_no_embedded_egress_rules_tfchecks.json deleted file mode 100644 index ce43e66..0000000 --- a/.tfsec/sg_no_embedded_egress_rules_tfchecks.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "checks": [ - { - "code": "CUS005", - "description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.", - "impact": "Embedded security group rules can cause issues during configuration updates.", - "resolution": "Move `egress` rules to `aws_security_group_rule` and attach to `aws_security_group`.", - "requiredTypes": [ - "resource" - ], - "requiredLabels": [ - "aws_security_group" - ], - "severity": "MEDIUM", - "matchSpec": { - "action": "notPresent", - "name": "egress" - }, - - "errorMessage": "`egress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.", - "relatedLinks": [ - "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule", - "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group" - ] - } - ] -} diff --git a/.tfsec/sg_no_embedded_ingress_rules_tfchecks.json b/.tfsec/sg_no_embedded_ingress_rules_tfchecks.json deleted file mode 100644 index 333ebc5..0000000 --- a/.tfsec/sg_no_embedded_ingress_rules_tfchecks.json +++ /dev/null @@ -1,27 +0,0 @@ -{ - "checks": [ - { - "code": "CUS004", - "description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.", - "impact": "Embedded security group rules can cause issues during configuration updates.", - "resolution": "Move `ingress` rules to `aws_security_group_rule` and attach to `aws_security_group`.", - "requiredTypes": [ - "resource" - ], - "requiredLabels": [ - "aws_security_group" - ], - "severity": "MEDIUM", - "matchSpec": { - "action": "notPresent", - "name": "ingress" - }, - - "errorMessage": "`ingress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.", - "relatedLinks": [ - "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule", - "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group" - ] - } - ] -}