You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Result #1 CRITICAL Instance is exposed publicly.
────────────────────────────────────────────────────────────────────────────────
database.tf:19
────────────────────────────────────────────────────────────────────────────────
5 resource "aws_db_instance" "database" {
.
19 [ publicly_accessible = true (true)
20 }
────────────────────────────────────────────────────────────────────────────────
ID aws-rds-no-public-db-access
Impact The database instance is publicly accessible
Resolution Set the database to not be publicly accessible
Result #2 CRITICAL Security group rule allows ingress from public internet.
────────────────────────────────────────────────────────────────────────────────
database.tf:51
────────────────────────────────────────────────────────────────────────────────
43 resource "aws_security_group" "db" {
..
51 [ cidr_blocks = ["0.0.0.0/0"]
..
59 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-ingress-sgr
Impact Your port exposed to the internet
Resolution Set a more restrictive cidr range
Result #3 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
database.tf:57
────────────────────────────────────────────────────────────────────────────────
43 resource "aws_security_group" "db" {
..
57 [ cidr_blocks = ["0.0.0.0/0"]
..
59 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
Result #4 CRITICAL Security group rule allows ingress from public internet.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:213
────────────────────────────────────────────────────────────────────────────────
203 resource "aws_security_group" "cluster_ec2" {
...
213 [ cidr_blocks = ["0.0.0.0/0"]
...
248 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-ingress-sgr
Impact Your port exposed to the internet
Resolution Set a more restrictive cidr range
Result #5 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:238
────────────────────────────────────────────────────────────────────────────────
203 resource "aws_security_group" "cluster_ec2" {
...
238 [ cidr_blocks = ["0.0.0.0/0"]
...
248 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
Result #6 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:455
────────────────────────────────────────────────────────────────────────────────
439 resource "aws_security_group" "ecs_service" {
...
455 [ cidr_blocks = ["0.0.0.0/0"]
...
457 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
Result #7 CRITICAL Security group rule allows ingress from public internet.
────────────────────────────────────────────────────────────────────────────────
loadbalancer.tf:11
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_security_group" "chaps_lb_sc" {
.
11 [ cidr_blocks = ["0.0.0.0/0"]
..
21 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-ingress-sgr
Impact Your port exposed to the internet
Resolution Set a more restrictive cidr range
Result #8 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
loadbalancer.tf:19
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_security_group" "chaps_lb_sc" {
.
19 [ cidr_blocks = ["0.0.0.0/0"]
..
21 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
Result #11 HIGH Launch template does not require IMDS access to require a token
────────────────────────────────────────────────────────────────────────────────
ecs.tf:267
────────────────────────────────────────────────────────────────────────────────
254 resource "aws_launch_template" "ec2-launch-template" {
...
267 [ http_tokens = "optional" ("optional")
...
309 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-enforce-launch-config-http-token-imds
Impact Instance metadata service can be interacted with freely
Resolution Enable HTTP token requirement for IMDS
Result #12 HIGH IAM policy document uses wildcarded action 'ecr:'
────────────────────────────────────────────────────────────────────────────────
ecs.tf:372-379
────────────────────────────────────────────────────────────────────────────────
363 resource "aws_iam_role_policy" "app_execution" {
...
372 ┌ "Action": [
373 │ "ecr:",
374 │ "logs:CreateLogGroup",
375 │ "logs:CreateLogStream",
376 │ "logs:PutLogEvents",
377 │ "logs:DescribeLogStreams",
378 └ "secretsmanager:GetSecretValue"
...
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #13 HIGH IAM policy document uses sensitive action 'ecr:' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
ecs.tf:380
────────────────────────────────────────────────────────────────────────────────
363 resource "aws_iam_role_policy" "app_execution" {
...
380 [ "Resource": "*",
...
386 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
ecs.tf:415-437 (aws_iam_role_policy.app_task) 3 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #17 HIGH IAM policy document uses sensitive action 'logs:CreateLogStream' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
ecs.tf:432
────────────────────────────────────────────────────────────────────────────────
415 resource "aws_iam_role_policy" "app_task" {
...
432 [ "Resource": ""
...
437 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #18 HIGH Application load balancer is not set to drop invalid headers.
────────────────────────────────────────────────────────────────────────────────
loadbalancer.tf:23-28
────────────────────────────────────────────────────────────────────────────────
23 resource "aws_lb" "chaps_lb" {
24 name = "chaps-load-balancer"
25 load_balancer_type = "application"
26 security_groups = [aws_security_group.chaps_lb_sc.id]
27 subnets = data.aws_subnets.shared-public.ids
28 }
────────────────────────────────────────────────────────────────────────────────
ID aws-elb-drop-invalid-headers
Impact Invalid headers being passed through to the target of the load balance may exploit vulnerabilities
Resolution Set drop_invalid_header_fields to true
Result #19 HIGH Load balancer is exposed publicly.
────────────────────────────────────────────────────────────────────────────────
loadbalancer.tf:23-28
────────────────────────────────────────────────────────────────────────────────
23 resource "aws_lb" "chaps_lb" {
24 name = "chaps-load-balancer"
25 load_balancer_type = "application"
26 security_groups = [aws_security_group.chaps_lb_sc.id]
27 subnets = data.aws_subnets.shared-public.ids
28 }
────────────────────────────────────────────────────────────────────────────────
ID aws-elb-alb-not-public
Impact The load balancer is exposed on the internet
Resolution Switch to an internal load balancer or add a tfsec ignore
Result #20 HIGH No public access block so not blocking public acls
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-block-public-acls
Impact PUT calls with public ACLs specified can make objects public
Resolution Enable blocking any PUT calls with a public ACL specified
Result #21 HIGH No public access block so not blocking public policies
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-block-public-policy
Impact Users could put a policy that allows public access
Resolution Prevent policies that allow public access being PUT
Result #22 HIGH Bucket does not have encryption enabled
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-encryption
Impact The bucket objects could be read if compromised
Resolution Configure bucket encryption
Result #23 HIGH No public access block so not ignoring public acls
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-ignore-public-acls
Impact PUT calls with public ACLs specified can make objects public
Resolution Enable ignoring the application of public ACLs in PUT calls
Result #24 HIGH No public access block so not restricting public buckets
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-no-public-buckets
Impact Public buckets can be accessed by anyone
Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)
Result #25 HIGH Bucket does not encrypt data with a customer managed key.
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-encryption-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Enable encryption using customer managed keys
Result #26 MEDIUM Instance has very low backup retention period.
────────────────────────────────────────────────────────────────────────────────
database.tf:5-20
────────────────────────────────────────────────────────────────────────────────
5 ┌ resource "aws_db_instance" "database" {
6 │ allocated_storage = local.application_data.accounts[local.environment].db_allocated_storage
7 │ storage_type = "gp2"
8 │ engine = "sqlserver-web"
9 │ engine_version = "14.00.3381.3.v1"
10 │ instance_class = local.application_data.accounts[local.environment].db_instance_class
11 │ identifier = local.application_data.accounts[local.environment].db_instance_identifier
12 │ username = local.application_data.accounts[local.environment].db_user
13 └ password = data.aws_secretsmanager_secret_version.db_password.secret_string
..
────────────────────────────────────────────────────────────────────────────────
ID aws-rds-specify-backup-retention
Impact Potential loss of data and short opportunity for recovery
Resolution Explicitly set the retention period to greater than the default
Result #28 MEDIUM Bucket does not have logging enabled
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-bucket-logging
Impact There is no way to determine the access to this bucket
Resolution Add a logging block to the resource to enable access logging
Result #29 MEDIUM Bucket does not have versioning enabled
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-enable-versioning
Impact Deleted or modified data would not be recoverable
Resolution Enable versioning to protect against accidental/malicious removal or modification
Result #33 LOW Security group rule does not have a description.
────────────────────────────────────────────────────────────────────────────────
database.tf:61-68
────────────────────────────────────────────────────────────────────────────────
61 resource "aws_security_group_rule" "allow_ec2_to_rds" {
62 type = "ingress"
63 from_port = 1433
64 to_port = 1433
65 protocol = "tcp"
66 source_security_group_id = aws_security_group.cluster_ec2.id
67 security_group_id = aws_security_group.db.id
68 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-add-description-to-security-group-rule
Impact Descriptions provide context for the firewall rule reasons
Resolution Add descriptions for all security groups rules
Result #36 LOW Log group is not encrypted.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:502-505
────────────────────────────────────────────────────────────────────────────────
502 resource "aws_cloudwatch_log_group" "cloudwatch_group" {
503 name = "${local.application_name}-ecs"
504 retention_in_days = 30
505 }
────────────────────────────────────────────────────────────────────────────────
ID aws-cloudwatch-log-group-customer-key
Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
Resolution Enable CMK encryption of CloudWatch Log Groups
Result #37 LOW Log group is not encrypted.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:63-66
────────────────────────────────────────────────────────────────────────────────
63 resource "aws_cloudwatch_log_group" "deployment_logs" {
64 name = "/aws/events/deploymentLogs"
65 retention_in_days = "7"
66 }
────────────────────────────────────────────────────────────────────────────────
ID aws-cloudwatch-log-group-customer-key
Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
Resolution Enable CMK encryption of CloudWatch Log Groups
Result #38 LOW Bucket does not have a corresponding public access block.
────────────────────────────────────────────────────────────────────────────────
s3.tf:1-3
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_s3_bucket" "chaps-db-backup-bucket" {
2 bucket = local.application_data.accounts[local.environment].s3_bucket_name
3 }
────────────────────────────────────────────────────────────────────────────────
ID aws-s3-specify-public-access-block
Impact Public access policies may be applied to sensitive data buckets
Resolution Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
terraform/environments/cdpt-chaps
*****************************
Running tflint in terraform/environments/cdpt-chaps
Excluding the following checks: terraform_unused_declarations
2issue(s) found:
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/cdpt-chaps/ecs.tf line 142:142:Name="${local.application_name}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)
on terraform/environments/cdpt-chaps/secrets.tf line 8:8:resource"random_password""password" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.mdtflint_exitcode=2
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
bot
added
the
environments-repository
drobinson-moj
had a problem deploying
to
hmpps-domain-services-development
GitHub Actions
Failure
Create load balancer cert and set NS records for the new zones