update webhost

[jluevan13]

No description provided.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

  AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2)
    Resource: aws_instance.web_host | Bridgecrew ID: 1043237819080398848_AWS_1681203923846 | Checkov ID: CKV_AWS_79

Description

https://docs.bridgecrew.io/docs/bc_aws_general_31

Benchmarks

• FEDRAMP (MODERATE) AC-6

[prisma-cloud-devsecops]

  EBS volumes do not have encrypted launch configurations
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_GENERAL_13 | Checkov ID: CKV_AWS_8

How to Fix

resource "aws_launch_configuration" "example" {
  ...
  instance_type = "t2.micro"
+ root_block_device {
+ encrypted     = true
+ }
  ...
}

Description

Amazon Elastic Block Store (EBS) volumes allow you to create encrypted launch configurations when creating EC2 instances and auto scaling. When the entire EBS volume is encrypted, data stored at rest on the volume, disk I/O, snapshots created from the volume, and data in-transit between EBS and EC2 are all encrypted.

Benchmarks

• PCI-DSS V3.2 3

[prisma-cloud-devsecops]

Suggested change

	resource "aws_instance" "web_host" {
	resource "aws_instance" "web_host" {
	# ec2 have plain text secrets in user data
	# test change2
	ami = var.ami
	instance_type = "t2.nano"
	vpc_security_group_ids = [
	"${aws_security_group.web-node.id}"]
	subnet_id = aws_subnet.web_subnet.id
	user_data = <<EOF
	#! /bin/bash
	sudo apt-get update
	sudo apt-get install -y apache2
	sudo systemctl start apache2
	sudo systemctl enable apache2
	export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA
	export AWS_SECRET_ACCESS_KEY=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
	export AWS_DEFAULT_REGION=us-west-2
	echo "<h1>Deployed via Terraform</h1>" | sudo tee /var/www/html/index.html
	EOF
	tags = merge({
	Name = "${local.resource_prefix.value}-ec2"
	}, {
	git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
	git_file = "terraform/aws/ec2.tf"
	git_last_modified_at = "2020-06-16 14:46:24"
	git_last_modified_by = "nimrodkor@gmail.com"
	git_modifiers = "nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6"
	})
	ebs_optimized = true
	}

  EC2 EBS is not optimized
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_GENERAL_68 | Checkov ID: CKV_AWS_135

How to Fix

resource "aws_instance" "foo" {
  ...
+ ebs_optimized = true
}

Description

Ensuring that EC2 instances are EBS-optimized will help to deliver enhanced performance for EBS workloads. They provide dedicated throughput to Amazon Elastic Block Store (EBS) volumes, which can result in improved EBS performance. Additionally, EBS-optimized instances use a separate network connection for EBS traffic, which can reduce network latency and improve the performance of EBS-intensive workloads.

🪄 Smart Fix -

Fix based on 100% past actions in this repository

[prisma-cloud-devsecops]

Suggested change

	resource "aws_instance" "web_host" {
	resource "aws_instance" "web_host" {
	# ec2 have plain text secrets in user data
	# test change2
	ami = var.ami
	instance_type = "t2.nano"
	vpc_security_group_ids = [
	"${aws_security_group.web-node.id}"]
	subnet_id = aws_subnet.web_subnet.id
	tags = merge({
	Name = "${local.resource_prefix.value}-ec2"
	}, {
	git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
	git_file = "terraform/aws/ec2.tf"
	git_last_modified_at = "2020-06-16 14:46:24"
	git_last_modified_by = "nimrodkor@gmail.com"
	git_modifiers = "nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6"
	})
	}

  EC2 user data exposes secrets
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_SECRETS_1 | Checkov ID: CKV_AWS_46

How to Fix

resource "aws_instance" "web" {
    ...
    instance_type = "t3.micro"
-    user_data = "access_key=123456ABCDEFGHIJZTLA and secret_key=AAAaa+Aa4AAaAA6aAkA0Ad+Aa8aA1aaaAAAaAaA"
}

Description

**User Data** is a metadata field of an EC2 instance that allows custom code to run after the instance is launched. It contains code exposed to any entity which has the most basic access to EC2, even read-only configurations. This code is not encrypted.

Removing secrets from easily-accessed unencrypted places reduces the risk of passwords, private keys and more from being exposed to third parties.

🪄 Smart Fix -

Fix based on 100% past actions in this repository

[prisma-cloud-devsecops]

Suggested change

	resource "aws_instance" "web_host" {
	resource "aws_instance" "web_host" {
	# ec2 have plain text secrets in user data
	# test change2
	ami = var.ami
	instance_type = "t2.nano"
	vpc_security_group_ids = [
	"${aws_security_group.web-node.id}"]
	subnet_id = aws_subnet.web_subnet.id
	user_data = <<EOF
	#! /bin/bash
	sudo apt-get update
	sudo apt-get install -y apache2
	sudo systemctl start apache2
	sudo systemctl enable apache2
	export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA
	export AWS_SECRET_ACCESS_KEY=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
	export AWS_DEFAULT_REGION=us-west-2
	echo "<h1>Deployed via Terraform</h1>" | sudo tee /var/www/html/index.html
	EOF
	tags = merge({
	Name = "${local.resource_prefix.value}-ec2"
	}, {
	git_commit = "d68d2897add9bc2203a5ed0632a5cdd8ff8cefb0"
	git_file = "terraform/aws/ec2.tf"
	git_last_modified_at = "2020-06-16 14:46:24"
	git_last_modified_by = "nimrodkor@gmail.com"
	git_modifiers = "nimrodkor"
	git_org = "bridgecrewio"
	git_repo = "terragoat"
	yor_trace = "347af3cd-4f70-4632-aca3-4d5e30ffc0b6"
	})
	monitoring = true
	}

  AWS EC2 instance detailed monitoring disabled
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_LOGGING_26 | Checkov ID: CKV_AWS_126

How to Fix

 resource "aws_instance" "test" {
+  monitoring = true   
 }

Description

Enabling detailed monitoring for Amazon Elastic Compute Cloud (EC2) instances can provide you with additional data and insights about the performance and utilization of your instances. : Detailed monitoring can provide you with more data about the utilization of your instances, which can be helpful for capacity planning and optimization.

🪄 Smart Fix -

Fix based on 100% past actions in this repository