test

[jluevan13]

No description provided.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

  Weib Test S3
    Resource: aws_s3_bucket.data | Bridgecrew ID: 1043237819080398848_AWS_1673630255979

Description

Remove public access

[prisma-cloud-devsecops]

Suggested change

	# bucket is not encrypted
	resource "aws_s3_bucket" "data" {
	# bucket is public
	# bucket is not encrypted
	# bucket does not have access logs
	# bucket does not have versioning
	# test update
	bucket = "${local.resource_prefix.value}-data"
	force_destroy = true
	tags = merge({
	Name = "${local.resource_prefix.value}-data"
	Environment = local.resource_prefix.value
	}, {
	git_commit = "4d57f83ca4d3a78a44fb36d1dcf0d23983fa44f5"
	git_file = "terraform/aws/s3.tf"
	git_last_modified_at = "2022-05-18 07:08:06"
	git_last_modified_by = "nimrod@bridgecrew.io"
	git_modifiers = "34870196+LironElbaz/nimrod/nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "0874007d-903a-4b4c-945f-c9c233e13243"
	})
	}
	resource "aws_s3_bucket" "data_log_bucket" {
	bucket = "data-log-bucket"
	}
	resource "aws_s3_bucket_logging" "data" {
	bucket = aws_s3_bucket.data.id
	target_bucket = aws_s3_bucket.data_log_bucket.id
	target_prefix = "log/"
	}

  AWS Access logging not enabled on S3 buckets
    Resource: aws_s3_bucket.data | Bridgecrew ID: BC_AWS_S3_13 | Checkov ID: CKV_AWS_18

How to Fix

resource "aws_s3_bucket" "bucket" {
  acl    = var.s3_bucket_acl
  bucket = var.s3_bucket_name
  policy = var.s3_bucket_policy

  force_destroy = var.s3_bucket_force_destroy
  versioning {
    enabled    = var.versioning
    mfa_delete = var.mfa_delete
  }

+  dynamic "logging" {
+    for_each = var.logging
+    content {
+      target_bucket = logging.value["target_bucket"]
+      target_prefix = "log/${var.s3_bucket_name}"
+    }
+  }
}

Description

Access logging provides detailed audit logging for all objects and folders in an S3 bucket.

Benchmarks

• HIPAA 164.312(B) Audit controls

🪄 Smart Fix -

Fix based on 100% past actions in this repository

[prisma-cloud-devsecops]

  Weibeler - Public S3 Buckets
    Resource: aws_s3_bucket.data | Bridgecrew ID: 1043237819080398848_AWS_1668813444422

[prisma-cloud-devsecops]

  AWS S3 Object Versioning is disabled
    Resource: aws_s3_bucket.data | Bridgecrew ID: BC_AWS_S3_16 | Checkov ID: CKV_AWS_21

How to Fix

resource "aws_s3_bucket" "state_bucket" {
  bucket        = "${data.aws_caller_identity.current.account_id}-terraform-state"
  acl           = var.acl
  force_destroy = var.force_destroy

+  versioning {
+    enabled    = true
+  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = var.sse_algorithm
      }
    }
  }

  tags = var.common_tags
}

Description

S3 versioning is a managed data backup and recovery service provided by AWS. When enabled it allows users to retrieve and restore previous versions of their buckets.

S3 versioning can be used for data protection and retention scenarios such as recovering objects that have been accidentally/intentionally deleted or overwritten.

Benchmarks

• FEDRAMP (MODERATE) CP-10, SI-12
• PCI-DSS V3.2.1 10.5.3

     🎉   Fixed by commit e3e9f4d - update webhost

🪄 Smart Fix -

Fix based on 100% past actions in this repository

[prisma-cloud-devsecops]

  AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2)
    Resource: aws_instance.web_host | Bridgecrew ID: 1043237819080398848_AWS_1681203923846 | Checkov ID: CKV_AWS_79

Description

https://docs.bridgecrew.io/docs/bc_aws_general_31

Benchmarks

• FEDRAMP (MODERATE) AC-6

[prisma-cloud-devsecops]

Suggested change

	# bucket is not encrypted
	resource "aws_s3_bucket" "data" {
	# bucket is public
	# bucket is not encrypted
	# bucket does not have access logs
	# bucket does not have versioning
	# test update
	bucket = "${local.resource_prefix.value}-data"
	force_destroy = true
	tags = merge({
	Name = "${local.resource_prefix.value}-data"
	Environment = local.resource_prefix.value
	}, {
	git_commit = "4d57f83ca4d3a78a44fb36d1dcf0d23983fa44f5"
	git_file = "terraform/aws/s3.tf"
	git_last_modified_at = "2022-05-18 07:08:06"
	git_last_modified_by = "nimrod@bridgecrew.io"
	git_modifiers = "34870196+LironElbaz/nimrod/nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "0874007d-903a-4b4c-945f-c9c233e13243"
	})
	}
	resource "aws_s3_bucket_versioning" "data" {
	bucket = aws_s3_bucket.data.id
	versioning_configuration {
	status = "Enabled"
	}
	}

  AWS S3 Object Versioning is disabled
    Resource: aws_s3_bucket.data | Bridgecrew ID: 1043237819080398848_AWS_1681219068903 | Checkov ID: CKV_AWS_21

Description

https://docs.bridgecrew.io/docs/s3_16-enable-versioning

Benchmarks

• FEDRAMP (MODERATE) CP-10, SI-12
• PCI-DSS V3.2.1 10.5.3

🪄 Smart Fix -

Fix based on 100% past actions in this repository

[prisma-cloud-devsecops]

  EBS volumes do not have encrypted launch configurations
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_GENERAL_13 | Checkov ID: CKV_AWS_8

How to Fix

resource "aws_launch_configuration" "example" {
  ...
  instance_type = "t2.micro"
+ root_block_device {
+ encrypted     = true
+ }
  ...
}

Description

Amazon Elastic Block Store (EBS) volumes allow you to create encrypted launch configurations when creating EC2 instances and auto scaling. When the entire EBS volume is encrypted, data stored at rest on the volume, disk I/O, snapshots created from the volume, and data in-transit between EBS and EC2 are all encrypted.

Benchmarks

• PCI-DSS V3.2 3

[prisma-cloud-devsecops]

Suggested change

	resource "aws_instance" "web_host" {
	resource "aws_instance" "web_host" {
	# ec2 have plain text secrets in user data
	# test change
	ami = var.ami
	instance_type = "t2.nano"
	vpc_security_group_ids = [
	"${aws_security_group.web-node.id}"]
	subnet_id = aws_subnet.web_subnet.id
	user_data = <<EOF
	#! /bin/bash
	sudo apt-get update
	sudo apt-get install -y apache2
	sudo systemctl start apache2
	sudo systemctl enable apache2
	export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA
	export AWS_SECRET_ACCESS_KEY=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
	export AWS_DEFAULT_REGION=us-west-2
	echo "<h1>Deployed via Terraform</h1>" | sudo tee /var/www/html/index.html
	EOF
	tags = merge({
	Name = "${local.resource_prefix.value}-ec2"
	}, {
	git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
	git_file = "terraform/aws/ec2.tf"
	git_last_modified_at = "2020-06-16 14:46:24"
	git_last_modified_by = "nimrodkor@gmail.com"
	git_modifiers = "nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6"
	})
	ebs_optimized = true
	}

  EC2 EBS is not optimized
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_GENERAL_68 | Checkov ID: CKV_AWS_135

How to Fix

resource "aws_instance" "foo" {
  ...
+ ebs_optimized = true
}

Description

Ensuring that EC2 instances are EBS-optimized will help to deliver enhanced performance for EBS workloads. They provide dedicated throughput to Amazon Elastic Block Store (EBS) volumes, which can result in improved EBS performance. Additionally, EBS-optimized instances use a separate network connection for EBS traffic, which can reduce network latency and improve the performance of EBS-intensive workloads.

🪄 Smart Fix -

Fix based on 100% past actions in this repository

[prisma-cloud-devsecops]

Suggested change

	resource "aws_instance" "web_host" {
	resource "aws_instance" "web_host" {
	# ec2 have plain text secrets in user data
	# test change
	ami = var.ami
	instance_type = "t2.nano"
	vpc_security_group_ids = [
	"${aws_security_group.web-node.id}"]
	subnet_id = aws_subnet.web_subnet.id
	user_data = <<EOF
	#! /bin/bash
	sudo apt-get update
	sudo apt-get install -y apache2
	sudo systemctl start apache2
	sudo systemctl enable apache2
	export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA
	export AWS_SECRET_ACCESS_KEY=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
	export AWS_DEFAULT_REGION=us-west-2
	echo "<h1>Deployed via Terraform</h1>" | sudo tee /var/www/html/index.html
	EOF
	tags = merge({
	Name = "${local.resource_prefix.value}-ec2"
	}, {
	git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
	git_file = "terraform/aws/ec2.tf"
	git_last_modified_at = "2020-06-16 14:46:24"
	git_last_modified_by = "nimrodkor@gmail.com"
	git_modifiers = "nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6"
	})
	monitoring = true
	}

  AWS EC2 instance detailed monitoring disabled
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_LOGGING_26 | Checkov ID: CKV_AWS_126

How to Fix

 resource "aws_instance" "test" {
+  monitoring = true   
 }

Description

Enabling detailed monitoring for Amazon Elastic Compute Cloud (EC2) instances can provide you with additional data and insights about the performance and utilization of your instances. : Detailed monitoring can provide you with more data about the utilization of your instances, which can be helpful for capacity planning and optimization.

🪄 Smart Fix -

Fix based on 100% past actions in this repository

[prisma-cloud-devsecops]

Suggested change

	resource "aws_instance" "web_host" {
	resource "aws_instance" "web_host" {
	# ec2 have plain text secrets in user data
	# test change
	ami = var.ami
	instance_type = "t2.nano"
	vpc_security_group_ids = [
	"${aws_security_group.web-node.id}"]
	subnet_id = aws_subnet.web_subnet.id
	tags = merge({
	Name = "${local.resource_prefix.value}-ec2"
	}, {
	git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
	git_file = "terraform/aws/ec2.tf"
	git_last_modified_at = "2020-06-16 14:46:24"
	git_last_modified_by = "nimrodkor@gmail.com"
	git_modifiers = "nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6"
	})
	}

  EC2 user data exposes secrets
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_SECRETS_1 | Checkov ID: CKV_AWS_46

How to Fix

resource "aws_instance" "web" {
    ...
    instance_type = "t3.micro"
-    user_data = "access_key=123456ABCDEFGHIJZTLA and secret_key=AAAaa+Aa4AAaAA6aAkA0Ad+Aa8aA1aaaAAAaAaA"
}

Description

**User Data** is a metadata field of an EC2 instance that allows custom code to run after the instance is launched. It contains code exposed to any entity which has the most basic access to EC2, even read-only configurations. This code is not encrypted.

Removing secrets from easily-accessed unencrypted places reduces the risk of passwords, private keys and more from being exposed to third parties.

🪄 Smart Fix -

Fix based on 100% past actions in this repository