add managed policy exclusivity, replace deprecated `manged_policy_arn` value #496

robertsweetman · 2024-12-06T12:16:38Z

We get persistent warnings that managed_policy_arn is deprecated.

Replace this with resource aws_iam_role_policy_attachments_exclusive in response to deployment warnings:

│ Warning: Argument is deprecated
│ 
│   with module.baseline.module.ec2_instance["t1-ncr-db-1-a"].aws_iam_role.this,
│   on .terraform/modules/baseline.ec2_instance/main.tf line 343, in resource "aws_iam_role" "this":
│  343:   managed_policy_arns = var.instance_profile_policies
│ 
│ The managed_policy_arns argument is deprecated. Use the
│ aws_iam_role_policy_attachment resource instead. If Terraform should
│ exclusively manage all managed policy attachments (the current behavior of
│ this argument), use the aws_iam_role_policy_attachments_exclusive resource
│ as well.

Using the 'exclusive' variant of this resource as it says that's the current behavior of managed_policy_arn that's being replaced.

github-actions · 2024-12-06T12:18:47Z

`Trivy Scan` Success

Show Output

```hcl

Trivy will check the following folders:

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:

`CTFLint Scan` Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:

`Trivy Scan` Success

Show Output

*****************************

Trivy will check the following folders:

…tance_profile_policies` to a map variable

github-actions · 2024-12-09T12:38:14Z

`Trivy Scan` Failed

Show Output

```hcl

Trivy will check the following folders:
test/unit-test

Running Trivy in test/unit-test
2024-12-09T12:38:03Z INFO [vulndb] Need to update DB
2024-12-09T12:38:03Z INFO [vulndb] Downloading vulnerability DB...
2024-12-09T12:38:03Z INFO [vulndb] Downloading artifact... repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-12-09T12:38:06Z INFO [vulndb] Artifact successfully downloaded repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-12-09T12:38:06Z INFO [vuln] Vulnerability scanning is enabled
2024-12-09T12:38:06Z INFO [misconfig] Misconfiguration scanning is enabled
2024-12-09T12:38:06Z INFO [misconfig] Need to update the built-in checks
2024-12-09T12:38:06Z INFO [misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-12-09T12:38:07Z INFO [secret] Secret scanning is enabled
2024-12-09T12:38:07Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-12-09T12:38:07Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.58/docs/scanner/secret#recommendation for faster secret detection
2024-12-09T12:38:08Z INFO [terraform scanner] Scanning root module file_path="."
2024-12-09T12:38:08Z WARN [terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly. module="root" variables="networking"
2024-12-09T12:38:08Z INFO [terraform executor] Ignore finding rule="aws-ec2-enforce-launch-config-http-token-imds" range="../../main.tf:44"
2024-12-09T12:38:08Z INFO Number of language-specific files num=0
2024-12-09T12:38:08Z INFO Detected config files num=3

security-groups.tf (terraform)

Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 2, CRITICAL: 2)

AVD-AWS-0104 (CRITICAL): Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/aws-vpc-no-public-egress-sgr
────────────────────────────────────────
security-groups.tf:25
via security-groups.tf:20-28 (egress)
via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
1 resource "aws_security_group" "test" {
.
25 [ ipv6_cidr_blocks = ["::/0"]
..
33 }
────────────────────────────────────────

AVD-AWS-0104 (CRITICAL): Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

See https://avd.aquasec.com/misconfig/aws-vpc-no-public-egress-sgr
────────────────────────────────────────
security-groups.tf:24
via security-groups.tf:20-28 (egress)
via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
1 resource "aws_security_group" "test" {
.
24 [ cidr_blocks = ["0.0.0.0/0"]
..
33 }
────────────────────────────────────────

AVD-AWS-0107 (HIGH): Security group rule allows ingress from public internet.
════════════════════════════════════════
Security groups provide stateful filtering of ingress and egress network traffic to AWS
resources. It is recommended that no security group allows unrestricted ingress access to
remote server administration ports, such as SSH to port 22 and RDP to port 3389.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
security-groups.tf:14
via security-groups.tf:9-18 (ingress)
via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
1 resource "aws_security_group" "test" {
.
14 [ ipv6_cidr_blocks = ["::/0"]
..
33 }
────────────────────────────────────────

AVD-AWS-0107 (HIGH): Security group rule allows ingress from public internet.
════════════════════════════════════════
Security groups provide stateful filtering of ingress and egress network traffic to AWS
resources. It is recommended that no security group allows unrestricted ingress access to
remote server administration ports, such as SSH to port 22 and RDP to port 3389.

See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
security-groups.tf:13
via security-groups.tf:9-18 (ingress)
via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
1 resource "aws_security_group" "test" {
.
13 [ cidr_blocks = ["0.0.0.0/0"]
..
33 }
────────────────────────────────────────

trivy_exitcode=1

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
test/unit-test

*****************************

Running Checkov in test/unit-test
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
terraform scan results:

Passed checks: 70, Failed checks: 1, Skipped checks: 13

Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1"
	FAILED for resource: aws_security_group.test
	File: /security-groups.tf:1-33

		1  | resource "aws_security_group" "test" {
		2  |   #checkov:skip=CKV2_AWS_5:
		3  |   #checkov:skip=CKV_AWS_25:
		4  |   #checkov:skip=CKV_AWS_24:
		5  |   #checkov:skip=CKV_AWS_260:
		6  |   name        = "Terratest-SG"
		7  |   description = "Test SG for Terratest"
		8  |   vpc_id      = data.aws_vpc.shared.id
		9  |   ingress {
		10 |     from_port        = 0
		11 |     to_port          = 6000
		12 |     protocol         = "tcp"
		13 |     cidr_blocks      = ["0.0.0.0/0"]
		14 |     ipv6_cidr_blocks = ["::/0"]
		15 |     description      = "Test SG for Terratest"
		16 | 
		17 | 
		18 |   }
		19 | 
		20 |   egress {
		21 |     from_port        = 0
		22 |     to_port          = 0
		23 |     protocol         = "-1"
		24 |     cidr_blocks      = ["0.0.0.0/0"]
		25 |     ipv6_cidr_blocks = ["::/0"]
		26 |     description      = "Test SG for Terratest"
		27 | 
		28 |   }
		29 | 
		30 |   tags = {
		31 |     Name = "test"
		32 |   }
		33 | }


checkov_exitcode=1

`CTFLint Scan` Failed

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
test/unit-test

*****************************

Running tflint in test/unit-test
Excluding the following checks: terraform_unused_declarations
1 issue(s) found:

Warning: Missing version constraint for provider "http" in `required_providers` (terraform_required_providers)

  on test/unit-test/locals.tf line 6:
   6: data "http" "environments_file" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.9.1/docs/rules/terraform_required_providers.md

tflint_exitcode=2

`Trivy Scan` Failed

Show Output

*****************************

Trivy will check the following folders:
test/unit-test

*****************************

Running Trivy in test/unit-test
2024-12-09T12:38:03Z	INFO	[vulndb] Need to update DB
2024-12-09T12:38:03Z	INFO	[vulndb] Downloading vulnerability DB...
2024-12-09T12:38:03Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-12-09T12:38:06Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2024-12-09T12:38:06Z	INFO	[vuln] Vulnerability scanning is enabled
2024-12-09T12:38:06Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-12-09T12:38:06Z	INFO	[misconfig] Need to update the built-in checks
2024-12-09T12:38:06Z	INFO	[misconfig] Downloading the built-in checks...
160.80 KiB / 160.80 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2024-12-09T12:38:07Z	INFO	[secret] Secret scanning is enabled
2024-12-09T12:38:07Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-12-09T12:38:07Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.58/docs/scanner/secret#recommendation for faster secret detection
2024-12-09T12:38:08Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-12-09T12:38:08Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="networking"
2024-12-09T12:38:08Z	INFO	[terraform executor] Ignore finding	rule="aws-ec2-enforce-launch-config-http-token-imds" range="../../main.tf:44"
2024-12-09T12:38:08Z	INFO	Number of language-specific files	num=0
2024-12-09T12:38:08Z	INFO	Detected config files	num=3

security-groups.tf (terraform)
==============================
Tests: 4 (SUCCESSES: 0, FAILURES: 4)
Failures: 4 (HIGH: 2, CRITICAL: 2)

AVD-AWS-0104 (CRITICAL): Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.


See https://avd.aquasec.com/misconfig/aws-vpc-no-public-egress-sgr
────────────────────────────────────────
 security-groups.tf:25
   via security-groups.tf:20-28 (egress)
    via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
   1   resource "aws_security_group" "test" {
   .   
  25 [     ipv6_cidr_blocks = ["::/0"]
  ..   
  33   }
────────────────────────────────────────


AVD-AWS-0104 (CRITICAL): Security group rule allows egress to multiple public internet addresses.
════════════════════════════════════════
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.


See https://avd.aquasec.com/misconfig/aws-vpc-no-public-egress-sgr
────────────────────────────────────────
 security-groups.tf:24
   via security-groups.tf:20-28 (egress)
    via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
   1   resource "aws_security_group" "test" {
   .   
  24 [     cidr_blocks      = ["0.0.0.0/0"]
  ..   
  33   }
────────────────────────────────────────


AVD-AWS-0107 (HIGH): Security group rule allows ingress from public internet.
════════════════════════════════════════
Security groups provide stateful filtering of ingress and egress network traffic to AWS
resources. It is recommended that no security group allows unrestricted ingress access to
remote server administration ports, such as SSH to port 22 and RDP to port 3389.


See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 security-groups.tf:14
   via security-groups.tf:9-18 (ingress)
    via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
   1   resource "aws_security_group" "test" {
   .   
  14 [     ipv6_cidr_blocks = ["::/0"]
  ..   
  33   }
────────────────────────────────────────


AVD-AWS-0107 (HIGH): Security group rule allows ingress from public internet.
════════════════════════════════════════
Security groups provide stateful filtering of ingress and egress network traffic to AWS
resources. It is recommended that no security group allows unrestricted ingress access to
remote server administration ports, such as SSH to port 22 and RDP to port 3389.


See https://avd.aquasec.com/misconfig/avd-aws-0107
────────────────────────────────────────
 security-groups.tf:13
   via security-groups.tf:9-18 (ingress)
    via security-groups.tf:1-33 (aws_security_group.test)
────────────────────────────────────────
   1   resource "aws_security_group" "test" {
   .   
  13 [     cidr_blocks      = ["0.0.0.0/0"]
  ..   
  33   }
────────────────────────────────────────


trivy_exitcode=1

dms1981 · 2024-12-27T15:18:34Z

variables.tf

@@ -149,7 +149,10 @@ variable "iam_resource_names_prefix" {
 }

 variable "instance_profile_policies" {
-  type        = list(string)
+  type = map(string)
+  default = {


Could this value be moved up to the local value? As written, this PR would only add the AmazonSSMManagedInstanceCore policy when instance_profile_policies is not set. I'd like to preserve the original intent if possible by including this value directly into the local that the for expression is constructed from. Unless, of course, there's something I've missed?

add managed policy exclusivity, replace deprecated values

64e39ff

robertsweetman requested a review from a team as a code owner December 6, 2024 12:16

Use aws_iam_role_policy_attachment resource instead and change `ins…

85cdde8

…tance_profile_policies` to a map variable

dms1981 reviewed Dec 27, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add managed policy exclusivity, replace deprecated `manged_policy_arn` value #496

add managed policy exclusivity, replace deprecated `manged_policy_arn` value #496

robertsweetman commented Dec 6, 2024 •

edited

Loading

github-actions bot commented Dec 6, 2024

github-actions bot commented Dec 9, 2024

security-groups.tf (terraform)

dms1981 Dec 27, 2024

add managed policy exclusivity, replace deprecated manged_policy_arn value #496

Are you sure you want to change the base?

add managed policy exclusivity, replace deprecated manged_policy_arn value #496

Conversation

robertsweetman commented Dec 6, 2024 • edited Loading

github-actions bot commented Dec 6, 2024

Trivy Scan Success

CTFLint Scan Success

Trivy Scan Success

github-actions bot commented Dec 9, 2024

Trivy Scan Failed

security-groups.tf (terraform)

CTFLint Scan Failed

Trivy Scan Failed

dms1981 Dec 27, 2024

Choose a reason for hiding this comment

add managed policy exclusivity, replace deprecated `manged_policy_arn` value #496

add managed policy exclusivity, replace deprecated `manged_policy_arn` value #496

robertsweetman commented Dec 6, 2024 •

edited

Loading

`Trivy Scan` Success

`CTFLint Scan` Success

`Trivy Scan` Success

`Trivy Scan` Failed

`CTFLint Scan` Failed

`Trivy Scan` Failed