You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Result #1 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:223
────────────────────────────────────────────────────────────────────────────────
207 resource "aws_security_group" "ecs_service" {
...
223 [ cidr_blocks = ["0.0.0.0/0"]
...
225 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
load_balancer.tf:1-63 (aws_security_group.dacp_lb_sc) 5 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-ingress-sgr
Impact Your port exposed to the internet
Resolution Set a more restrictive cidr range
Result #7 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
load_balancer.tf:53
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_security_group" "dacp_lb_sc" {
.
53 [ cidr_blocks = ["0.0.0.0/0"]
..
63 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
Result #8 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
load_balancer.tf:61
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_security_group" "dacp_lb_sc" {
.
61 [ cidr_blocks = ["0.0.0.0/0"]
..
63 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
Result #9 CRITICAL Instance is exposed publicly.
────────────────────────────────────────────────────────────────────────────────
rds.tf:12
────────────────────────────────────────────────────────────────────────────────
1 resource "aws_db_instance" "dacp_db" {
.
12 [ publicly_accessible = true (true)
..
16 }
────────────────────────────────────────────────────────────────────────────────
ID aws-rds-no-public-db-access
Impact The database instance is publicly accessible
Resolution Set the database to not be publicly accessible
Result #10 CRITICAL Security group rule allows egress to multiple public internet addresses.
────────────────────────────────────────────────────────────────────────────────
rds.tf:57
────────────────────────────────────────────────────────────────────────────────
23 resource "aws_security_group" "postgresql_db_sc" {
..
57 [ cidr_blocks = ["0.0.0.0/0"]
..
60 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-no-public-egress-sgr
Impact Your port is egressing data to the internet
Resolution Set a more restrictive cidr range
ecs.tf:135-155 (aws_iam_role_policy.app_execution) 2 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #13 HIGH IAM policy document uses sensitive action 'ecr:' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
ecs.tf:149
────────────────────────────────────────────────────────────────────────────────
135 resource "aws_iam_role_policy" "app_execution" {
...
149 [ "Resource": "*",
...
155 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
ecs.tf:184-205 (aws_iam_role_policy.app_task) 4 instances
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #18 HIGH IAM policy document uses sensitive action 'logs:' on wildcarded resource ''
────────────────────────────────────────────────────────────────────────────────
ecs.tf:200
────────────────────────────────────────────────────────────────────────────────
184 resource "aws_iam_role_policy" "app_task" {
...
200 [ "Resource": "*"
...
205 }
────────────────────────────────────────────────────────────────────────────────
ID aws-iam-no-policy-wildcards
Impact Overly permissive policies may grant access to sensitive resources
Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards.
Result #19 HIGH Image scanning is not enabled.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:227-230
────────────────────────────────────────────────────────────────────────────────
227 resource "aws_ecr_repository" "dacp_ecr_repo" {
228 name = "dacp-ecr-repo"
229 force_delete = true
230 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ecr-enable-image-scans
Impact The ability to scan images is not being used and vulnerabilities will not be highlighted
Resolution Enable ECR image scanning
Result #20 HIGH Repository tags are mutable.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:227-230
────────────────────────────────────────────────────────────────────────────────
227 resource "aws_ecr_repository" "dacp_ecr_repo" {
228 name = "dacp-ecr-repo"
229 force_delete = true
230 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ecr-enforce-immutable-repository
Impact Image tags could be overwritten with compromised images
Resolution Only use immutable images in ECR
Result #21 HIGH Topic does not have encryption enabled.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:308-311
────────────────────────────────────────────────────────────────────────────────
308 resource "aws_sns_topic" "dacp_utilisation_alarm" {
309 count = local.is-development ? 0 : 1
310 name = "dacp_utilisation_alarm"
311 }
────────────────────────────────────────────────────────────────────────────────
ID aws-sns-enable-topic-encryption
Impact The SNS topic messages could be read if compromised
Resolution Turn on SNS Topic encryption
Result #22 HIGH Application load balancer is not set to drop invalid headers.
────────────────────────────────────────────────────────────────────────────────
load_balancer.tf:119-127
────────────────────────────────────────────────────────────────────────────────
119 resource "aws_lb" "dacp_lb" {
120 name = "dacp-load-balancer"
121 load_balancer_type = "application"
122 security_groups = [aws_security_group.dacp_lb_sc.id, aws_security_group.lb_sc_pingdom.id]
123 subnets = data.aws_subnets.shared-public.ids
124 enable_deletion_protection = false
125 internal = false
126 depends_on = [aws_security_group.dacp_lb_sc, aws_security_group.lb_sc_pingdom]
127 }
────────────────────────────────────────────────────────────────────────────────
ID aws-elb-drop-invalid-headers
Impact Invalid headers being passed through to the target of the load balance may exploit vulnerabilities
Resolution Set drop_invalid_header_fields to true
Result #25 HIGH Instance has Public Access enabled
────────────────────────────────────────────────────────────────────────────────
rds.tf:12
────────────────────────────────────────────────────────────────────────────────
12 publicly_accessible = true
────────────────────────────────────────────────────────────────────────────────
Rego Package builtin.aws.rds.aws0180
Rego Rule deny
────────────────────────────────────────────────────────────────────────────────
Result #26 MEDIUM Instance has very low backup retention period.
────────────────────────────────────────────────────────────────────────────────
rds.tf:1-16
────────────────────────────────────────────────────────────────────────────────
1 ┌ resource "aws_db_instance" "dacp_db" {
2 │ allocated_storage = local.application_data.accounts[local.environment].allocated_storage
3 │ db_name = local.application_data.accounts[local.environment].db_name
4 │ storage_type = local.application_data.accounts[local.environment].storage_type
5 │ engine = local.application_data.accounts[local.environment].engine
6 │ identifier = local.application_data.accounts[local.environment].identifier
7 │ engine_version = local.application_data.accounts[local.environment].engine_version
8 │ instance_class = local.application_data.accounts[local.environment].instance_class
9 └ username = local.application_data.accounts[local.environment].db_username
..
────────────────────────────────────────────────────────────────────────────────
ID aws-rds-specify-backup-retention
Impact Potential loss of data and short opportunity for recovery
Resolution Explicitly set the retention period to greater than the default
Result #30 LOW Repository is not encrypted using KMS.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:227-230
────────────────────────────────────────────────────────────────────────────────
227 resource "aws_ecr_repository" "dacp_ecr_repo" {
228 name = "dacp-ecr-repo"
229 force_delete = true
230 }
────────────────────────────────────────────────────────────────────────────────
ID aws-ecr-repository-customer-key
Impact Using AWS managed keys does not allow for fine grained control
Resolution Use customer managed keys
Result #31 LOW Log group is not encrypted.
────────────────────────────────────────────────────────────────────────────────
ecs.tf:9-12
────────────────────────────────────────────────────────────────────────────────
9 resource "aws_cloudwatch_log_group" "deployment_logs" {
10 name = "/aws/events/deploymentLogs"
11 retention_in_days = "7"
12 }
────────────────────────────────────────────────────────────────────────────────
ID aws-cloudwatch-log-group-customer-key
Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
Resolution Enable CMK encryption of CloudWatch Log Groups
Result #33 LOW Security group rule does not have a description.
────────────────────────────────────────────────────────────────────────────────
load_balancer.tf:71-116
────────────────────────────────────────────────────────────────────────────────
65 resource "aws_security_group" "lb_sc_pingdom" {
66 name = "load balancer Pingdom security group"
67 description = "control Pingdom access to the load balancer"
68 vpc_id = data.aws_vpc.shared.id
69
70 // Allow all European Pingdom IP addresses
71 ┌ ingress {
72 │ from_port = 443
73 └ to_port = 443
..
────────────────────────────────────────────────────────────────────────────────
ID aws-ec2-add-description-to-security-group-rule
Impact Descriptions provide context for the firewall rule reasons
Resolution Add descriptions for all security groups rules
Result #35 LOW Log group is not encrypted.
────────────────────────────────────────────────────────────────────────────────
rds.tf:87-90
────────────────────────────────────────────────────────────────────────────────
87 resource "aws_cloudwatch_log_group" "rds_logs" {
88 name = "/aws/events/rdsLogs"
89 retention_in_days = "7"
90 }
────────────────────────────────────────────────────────────────────────────────
ID aws-cloudwatch-log-group-customer-key
Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
Resolution Enable CMK encryption of CloudWatch Log Groups
*****************************
Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version:0.5.0)
tflint will check the following folders:
terraform/environments/dacp
*****************************
Running tflint in terraform/environments/dacp
Excluding the following checks: terraform_unused_declarations
12issue(s) found:
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 39:39:value="${aws_db_instance.dacp_db.address}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 43:43:value="${local.application_data.accounts[local.environment].rds_port}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 47:47:value="${aws_db_instance.dacp_db.username}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 51:51:value="${aws_db_instance.dacp_db.password}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 55:55:value="${aws_db_instance.dacp_db.db_name}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 59:59:value="${local.application_data.accounts[local.environment].support_email}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 63:63:value="${local.application_data.accounts[local.environment].support_team}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/ecs.tf line 67:67:value="${local.application_data.accounts[local.environment].client_id}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: Missing version constraint for provider "null" in `required_providers` (terraform_required_providers)
on terraform/environments/dacp/rds.tf line 66:66:resource"null_resource""setup_db" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/rds.tf line 83:83:always_run="${timestamp()}"
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.md
Warning: Missing version constraint for provider "random" in `required_providers` (terraform_required_providers)
on terraform/environments/dacp/secrets.tf line 2:2:resource"random_password""password" {
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md
Warning: [Fixable] Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)
on terraform/environments/dacp/secrets.tf line 18:18:secret_string=jsonencode({ "DACP_DB_PASSWORD":"${random_password.password.result}" })
Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_deprecated_interpolation.mdtflint_exitcode=2
code qualityFor PRs that improve, reformat, or refactor codeenvironments-repositoryUsed to exclude PRs from this repo in our Slack PR update
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
github-actions
bot
added
the
code quality
ep-93
had a problem deploying
to
maat-development
GitHub Actions
Failure
This pull request includes updates from the GitHub Actions Code Formatter workflow. Please review the changes and merge if everything looks good.