diff --git a/labs/lab6/analysis/ansible-analysis.txt b/labs/lab6/analysis/ansible-analysis.txt new file mode 100644 index 00000000..cea010d9 --- /dev/null +++ b/labs/lab6/analysis/ansible-analysis.txt @@ -0,0 +1,5 @@ +=== Ansible Security Analysis (KICS) === +KICS Ansible findings: 10 + HIGH severity: 9 + MEDIUM severity: 0 + LOW severity: 1 diff --git a/labs/lab6/analysis/checkov-terraform-report.txt b/labs/lab6/analysis/checkov-terraform-report.txt new file mode 100644 index 00000000..e69de29b diff --git a/labs/lab6/analysis/checkov-terraform-results.json b/labs/lab6/analysis/checkov-terraform-results.json new file mode 100644 index 00000000..e69de29b diff --git a/labs/lab6/analysis/kics-ansible-report.html b/labs/lab6/analysis/kics-ansible-report.html new file mode 100755 index 00000000..a8481ce7 --- /dev/null +++ b/labs/lab6/analysis/kics-ansible-report.html @@ -0,0 +1,52 @@ +KICS Scan ResultCheckmarx logo
KICS REPORT03/16/2026 20:03KICS.IO
KICS v2.1.20 +Scanned paths: /src +Platforms: Common, AnsibleStart time: 20:03:53, Mar 16 2026 +End time: 20:03:57, Mar 16 2026

Vulnerabilities:

0 +CRITICAL
9 +HIGH
0 +MEDIUM
1 +LOW
0 +INFO
10 +TOTAL

Passwords And Secrets - Generic Password

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (6)
File: ../../src/inventory.ini +Line 19
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
18ansible_become_password=<SECRET-MASKED-ON-PURPOSE>
19db_admin_password=<SECRET-MASKED-ON-PURPOSE>
20api_secret_key=<SECRET-MASKED-ON-PURPOSE>
File: ../../src/inventory.ini +Line 5
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
4[webservers]
5web1.example.com ansible_user=root ansible_password=<SECRET-MASKED-ON-PURPOSE>
6web2.example.com ansible_user=root ansible_ssh_pass=RootPass123!
File: ../../src/inventory.ini +Line 10
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
9# SECURITY ISSUE #36 - Using root user and default port
10db1.example.com ansible_user=root ansible_port=22 ansible_password=<SECRET-MASKED-ON-PURPOSE>
11
File: ../../src/deploy.yml +Line 12
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
11 # SECURITY ISSUE #1 - Hardcoded password in playbook!
12 db_password: <SECRET-MASKED-ON-PURPOSE>
13 # SECURITY ISSUE #2 - Hardcoded API key!
File: ../../src/inventory.ini +Line 18
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
17# SECURITY ISSUE #38 - Global variables with secrets
18ansible_become_password=<SECRET-MASKED-ON-PURPOSE>
19db_admin_password=<SECRET-MASKED-ON-PURPOSE>
File: ../../src/configure.yml +Line 16
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
15
16 admin_password: <SECRET-MASKED-ON-PURPOSE>
17

Passwords And Secrets - Generic Secret

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (1)
File: ../../src/inventory.ini +Line 20
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
19db_admin_password=<SECRET-MASKED-ON-PURPOSE>
20api_secret_key=<SECRET-MASKED-ON-PURPOSE>
21

Passwords And Secrets - Password in URL

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (2)
File: ../../src/deploy.yml +Line 16
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
15 # SECURITY ISSUE #3 - Database connection string with credentials
16 db_connection: <SECRET-MASKED-ON-PURPOSE>:5432/myapp"
17
File: ../../src/deploy.yml +Line 72
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
71 git:
72 repo: <SECRET-MASKED-ON-PURPOSE>/company/repo.git'
73 dest: /var/www/myapp

Unpinned Package Version

Platform: Ansible +CWE: 706 +Risk Score: 4.1 +Category: Supply-Chain
Setting state to latest performs an update and installs additional packages possibly resulting in performance degradation or loss of servicehttps://ansible.readthedocs.io/projects/lint/rules/package-latest/
Results (1)
File: ../../src/deploy.yml +Line 99
Expected: State's task when installing a package should not be defined as 'latest' or should have set 'update_only' to 'true' +Found: State's task is set to 'latest'
98 name: myapp
99 state: latest # Should pin specific version
100 update_cache: yes
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love:
+ + + + + + + + + +
The KICS project is powered by Checkmarx, global leader of Application Security Testing
\ No newline at end of file diff --git a/labs/lab6/analysis/kics-ansible-report.txt b/labs/lab6/analysis/kics-ansible-report.txt new file mode 100644 index 00000000..8ba7f69a --- /dev/null +++ b/labs/lab6/analysis/kics-ansible-report.txt @@ -0,0 +1,53 @@ + + + + MLLLLLM MLLLLLLLLL LLLLLLL KLLLLLLLLLLLLLLLL LLLLLLLLLLLLLLLLLLLLLLL + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMML KLMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LMMMMMMMMML MMMMMMMK LMMMMMMMMMLLMLLLLLLLLLLLLLL LMMMMMMMLLLLLLLLLLLLLLLLLLLLM + MMMMMMM MMMMMMMMMLM MMMMMMMK LMMMMMMMM LMMMMMML + MMMMMMMLMMMMMMMML MMMMMMMK MMMMMMML LMMMMMMMMLLLLLLLLLLLLLMLL + MMMMMMMMMMMMMMMM MMMMMMMK MMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMMMMMMMMMMMMM MMMMMMMK MMMMMMM LMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM KLMMMMMMMMML MMMMMMMK LMMMMMMM MMMMMMMML + MMMMMMM LMMMMMMMMMM MMMMMMMK LMMMMMMMMLL MMMMMMML + MMMMMMM LMMMMMMMMMLL MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMMML LLLLLLLLLLLLLLLLLLLLMMMMMMMMMM + MMMMMMM MMMMMMMMMMML MMMMMMMK MMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LLMMMMMMMMML MMMMMMMK LLMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM MMMMMMMMMML MMMMMMMK KLMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMLK + + + + +Scanning with Keeping Infrastructure as Code Secure v2.1.20 + + + Preparing Scan Assets: Done + + + + +Unpinned Package Version, Severity: LOW, Results: 1 + [1]: ../../src/deploy.yml:99 +Passwords And Secrets - Password in URL, Severity: HIGH, Results: 2 + [1]: ../../src/deploy.yml:72 + [2]: ../../src/deploy.yml:16 +Passwords And Secrets - Generic Secret, Severity: HIGH, Results: 1 + [1]: ../../src/inventory.ini:20 +Passwords And Secrets - Generic Password, Severity: HIGH, Results: 6 + [1]: ../../src/inventory.ini:5 + [2]: ../../src/configure.yml:16 + [3]: ../../src/deploy.yml:12 + [4]: ../../src/inventory.ini:19 + [5]: ../../src/inventory.ini:18 + [6]: ../../src/inventory.ini:10 + +Results Summary: +CRITICAL: 0 +HIGH: 9 +MEDIUM: 0 +LOW: 1 +INFO: 0 +TOTAL: 10 + diff --git a/labs/lab6/analysis/kics-ansible-results.json b/labs/lab6/analysis/kics-ansible-results.json new file mode 100755 index 00000000..23880dfb --- /dev/null +++ b/labs/lab6/analysis/kics-ansible-results.json @@ -0,0 +1,206 @@ +{ + "kics_version": "v2.1.20", + "files_scanned": 3, + "lines_scanned": 309, + "files_parsed": 3, + "lines_parsed": 260, + "lines_ignored": 49, + "files_failed_to_scan": 0, + "queries_total": 287, + "queries_failed_to_execute": 0, + "queries_failed_to_compute_similarity_id": 0, + "scan_id": "console", + "severity_counters": { + "CRITICAL": 0, + "HIGH": 9, + "INFO": 0, + "LOW": 1, + "MEDIUM": 0, + "TRACE": 0 + }, + "total_counter": 10, + "total_bom_resources": 0, + "start": "2026-03-16T20:03:53.408124895Z", + "end": "2026-03-16T20:03:57.482103047Z", + "paths": [ + "/src" + ], + "queries": [ + { + "query_name": "Passwords And Secrets - Generic Password", + "query_id": "487f4be7-3fd9-4506-a07a-eae252180c08", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/inventory.ini", + "similarity_id": "33738570f6448f344b956896d42f75b6216ace7814a46c8b6002d483c70c25b8", + "line": 19, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/inventory.ini", + "similarity_id": "21ca21d14467d66a7b83bdc36e6292b114d13bde377021c0ca107078a8afa0d4", + "line": 5, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/inventory.ini", + "similarity_id": "369901d122f4a6d8adec4bec409dc25e92c96ff37c26a145b681702f7971a6a1", + "line": 10, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/deploy.yml", + "similarity_id": "d6fbd659326192fbd0bfcc010d5fc97f5db716570596efd8b730ce20e6606683", + "line": 12, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/inventory.ini", + "similarity_id": "97e89fa95681e604d1c4504858554eef5df45cee2055fe4505a1e6c1baf30aa8", + "line": 18, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/configure.yml", + "similarity_id": "2a8df5710fcdceeff811ec6532d6bcba17d9b6c603d0fecdfecc87f3b128aac5", + "line": 16, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "Passwords And Secrets - Generic Secret", + "query_id": "3e2d3b2f-c22a-4df1-9cc6-a7a0aebb0c99", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/inventory.ini", + "similarity_id": "403da6866e75f1a26d35f59ab3d1763e8971d9febb1392b355bbbc357b156690", + "line": 20, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "Passwords And Secrets - Password in URL", + "query_id": "c4d3b58a-e6d4-450f-9340-04f1e702eaae", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/deploy.yml", + "similarity_id": "895e407b4fb7371dee128429969964f297da99fed47494dbb55bb0627fb8b7ff", + "line": 16, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/deploy.yml", + "similarity_id": "8c1dd50d50bac18f0c169f282f8af8782dfbc8f0c3271edb415981a73d6e5af5", + "line": 72, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "Unpinned Package Version", + "query_id": "c05e2c20-0a2c-4686-b1f8-5f0a5612d4e8", + "query_url": "https://ansible.readthedocs.io/projects/lint/rules/package-latest/", + "severity": "LOW", + "platform": "Ansible", + "cwe": "706", + "risk_score": "4.1", + "cloud_provider": "COMMON", + "category": "Supply-Chain", + "experimental": false, + "description": "Setting state to latest performs an update and installs additional packages possibly resulting in performance degradation or loss of service", + "description_id": "43e877b3", + "files": [ + { + "file_name": "../../src/deploy.yml", + "similarity_id": "314c76114114e1e23377a262e72590a75327039d9d6137b44fdb17922fe5f990", + "line": 99, + "resource_type": "apt", + "resource_name": "Install application", + "issue_type": "IncorrectValue", + "search_key": "name={{Install application}}.{{apt}}.state", + "search_line": -1, + "search_value": "", + "expected_value": "State's task when installing a package should not be defined as 'latest' or should have set 'update_only' to 'true'", + "actual_value": "State's task is set to 'latest'" + } + ] + } + ] +} diff --git a/labs/lab6/analysis/kics-pulumi-report.html b/labs/lab6/analysis/kics-pulumi-report.html new file mode 100755 index 00000000..fc1656a9 --- /dev/null +++ b/labs/lab6/analysis/kics-pulumi-report.html @@ -0,0 +1,50 @@ +KICS Scan ResultCheckmarx logo
KICS REPORT03/16/2026 20:00KICS.IO
KICS v2.1.20 +Scanned paths: /src +Platforms: Pulumi, CommonStart time: 20:00:52, Mar 16 2026 +End time: 20:00:53, Mar 16 2026

Vulnerabilities:

1 +CRITICAL
2 +HIGH
1 +MEDIUM
0 +LOW
2 +INFO
6 +TOTAL

RDS DB Instance Publicly Accessible

Platform: Pulumi +CWE: 284 +Risk Score: 8.7 +Category: Insecure Configurations
RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false.https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance/#publiclyaccessible_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 104
Expected: 'resources.unencryptedDb.properties.publiclyAccessible' should be set to 'false' +Found: 'resources.unencryptedDb.properties.publiclyAccessible' is set to 'true'
103 storageEncrypted: false # SECURITY ISSUE #7 - No encryption!
104 publiclyAccessible: true # SECURITY ISSUE #8 - Public access!
105 skipFinalSnapshot: true

DynamoDB Table Not Encrypted

Platform: Pulumi +CWE: 311 +Risk Score: 7.1 +Category: Encryption
AWS DynamoDB Tables should have serverSideEncryption enabledhttps://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#serversideencryption_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 205
Expected: Attribute 'serverSideEncryption' should be defined +Found: Attribute 'serverSideEncryption' is not defined
204 type: aws:dynamodb:Table
205 properties:
206 name: my-table-pulumi-yaml

Passwords And Secrets - Generic Password

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 16
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
15 # SECURITY ISSUE #1 - Hardcoded database password
16 dbPassword: <SECRET-MASKED-ON-PURPOSE>
17

EC2 Instance Monitoring Disabled

Platform: Pulumi +CWE: 778 +Risk Score: 5.1 +Category: Observability
EC2 Instance should have detailed monitoring enabled. With detailed monitoring enabled data is available in 1-minute periodshttps://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#monitoring_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 157
Expected: Attribute 'monitoring' should be defined and set to true +Found: Attribute 'monitoring' is not defined
156 type: aws:ec2:Instance
157 properties:
158 ami: ami-0c55b159cbfafe1f0

DynamoDB Table Point In Time Recovery Disabled

Platform: Pulumi +CWE: 459 +Risk Score: 0.0 +Category: Best Practices
It's considered a best practice to have point in time recovery enabled for DynamoDB Tablehttps://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#pointintimerecovery_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 213
Expected: Attribute 'enabled' in 'pointInTimeRecovery' should be set to true +Found: Attribute 'enabled' in 'pointInTimeRecovery' is set to false
212 pointInTimeRecovery:
213 enabled: false # SECURITY ISSUE #18 - No PITR
214 tags:

EC2 Not EBS Optimized

Platform: Pulumi +CWE: 459 +Risk Score: 0.0 +Category: Best Practices
It's considered a best practice for an EC2 instance to use an EBS optimized instance. This provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I/O and other traffic from your instancehttps://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#ebsoptimized_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 157
Expected: Attribute 'ebsOptimized' should be defined and set to true +Found: Attribute 'ebsOptimized' is not defined
156 type: aws:ec2:Instance
157 properties:
158 ami: ami-0c55b159cbfafe1f0
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love:
+ + + + + + + + + +
The KICS project is powered by Checkmarx, global leader of Application Security Testing
\ No newline at end of file diff --git a/labs/lab6/analysis/kics-pulumi-report.txt b/labs/lab6/analysis/kics-pulumi-report.txt new file mode 100644 index 00000000..85d0bf45 --- /dev/null +++ b/labs/lab6/analysis/kics-pulumi-report.txt @@ -0,0 +1,51 @@ + + + + MLLLLLM MLLLLLLLLL LLLLLLL KLLLLLLLLLLLLLLLL LLLLLLLLLLLLLLLLLLLLLLL + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMML KLMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LMMMMMMMMML MMMMMMMK LMMMMMMMMMLLMLLLLLLLLLLLLLL LMMMMMMMLLLLLLLLLLLLLLLLLLLLM + MMMMMMM MMMMMMMMMLM MMMMMMMK LMMMMMMMM LMMMMMML + MMMMMMMLMMMMMMMML MMMMMMMK MMMMMMML LMMMMMMMMLLLLLLLLLLLLLMLL + MMMMMMMMMMMMMMMM MMMMMMMK MMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMMMMMMMMMMMMM MMMMMMMK MMMMMMM LMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM KLMMMMMMMMML MMMMMMMK LMMMMMMM MMMMMMMML + MMMMMMM LMMMMMMMMMM MMMMMMMK LMMMMMMMMLL MMMMMMML + MMMMMMM LMMMMMMMMMLL MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMMML LLLLLLLLLLLLLLLLLLLLMMMMMMMMMM + MMMMMMM MMMMMMMMMMML MMMMMMMK MMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LLMMMMMMMMML MMMMMMMK LLMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM MMMMMMMMMML MMMMMMMK KLMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMLK + + + + +Scanning with Keeping Infrastructure as Code Secure v2.1.20 + + + Preparing Scan Assets: Done + + + + +EC2 Not EBS Optimized, Severity: INFO, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:157 +DynamoDB Table Point In Time Recovery Disabled, Severity: INFO, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:213 +EC2 Instance Monitoring Disabled, Severity: MEDIUM, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:157 +Passwords And Secrets - Generic Password, Severity: HIGH, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:16 +DynamoDB Table Not Encrypted, Severity: HIGH, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:205 +RDS DB Instance Publicly Accessible, Severity: CRITICAL, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:104 + +Results Summary: +CRITICAL: 1 +HIGH: 2 +MEDIUM: 1 +LOW: 0 +INFO: 2 +TOTAL: 6 + diff --git a/labs/lab6/analysis/kics-pulumi-results.json b/labs/lab6/analysis/kics-pulumi-results.json new file mode 100755 index 00000000..38b2756d --- /dev/null +++ b/labs/lab6/analysis/kics-pulumi-results.json @@ -0,0 +1,202 @@ +{ + "kics_version": "v2.1.20", + "files_scanned": 1, + "lines_scanned": 280, + "files_parsed": 1, + "lines_parsed": 261, + "lines_ignored": 19, + "files_failed_to_scan": 0, + "queries_total": 21, + "queries_failed_to_execute": 0, + "queries_failed_to_compute_similarity_id": 0, + "scan_id": "console", + "severity_counters": { + "CRITICAL": 1, + "HIGH": 2, + "INFO": 2, + "LOW": 0, + "MEDIUM": 1, + "TRACE": 0 + }, + "total_counter": 6, + "total_bom_resources": 0, + "start": "2026-03-16T20:00:52.990446728Z", + "end": "2026-03-16T20:00:53.293506459Z", + "paths": [ + "/src" + ], + "queries": [ + { + "query_name": "RDS DB Instance Publicly Accessible", + "query_id": "647de8aa-5a42-41b5-9faf-22136f117380", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance/#publiclyaccessible_yaml", + "severity": "CRITICAL", + "platform": "Pulumi", + "cwe": "284", + "risk_score": "8.7", + "cloud_provider": "AWS", + "category": "Insecure Configurations", + "experimental": false, + "description": "RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false.", + "description_id": "be6d13f0", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "d5a823d6c65082cd99457a40fbabdf497078bce057628d51e5ec141537ee5d53", + "line": 104, + "resource_type": "aws:rds:Instance", + "resource_name": "unencryptedDb", + "issue_type": "IncorrectValue", + "search_key": "resources[unencryptedDb].properties.publiclyAccessible", + "search_line": 104, + "search_value": "", + "expected_value": "'resources.unencryptedDb.properties.publiclyAccessible' should be set to 'false'", + "actual_value": "'resources.unencryptedDb.properties.publiclyAccessible' is set to 'true'" + } + ] + }, + { + "query_name": "DynamoDB Table Not Encrypted", + "query_id": "b6a7e0ae-aed8-4a19-a993-a95760bf8836", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#serversideencryption_yaml", + "severity": "HIGH", + "platform": "Pulumi", + "cwe": "311", + "risk_score": "7.1", + "cloud_provider": "AWS", + "category": "Encryption", + "experimental": false, + "description": "AWS DynamoDB Tables should have serverSideEncryption enabled", + "description_id": "fb6a0c51", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "15376a569938e2989eb0e9db7ff05213e04607ad547e550bbc579aaa5f64e8ce", + "line": 205, + "resource_type": "aws:dynamodb:Table", + "resource_name": "Unencrypted Table", + "issue_type": "MissingAttribute", + "search_key": "resources[unencryptedTable].properties", + "search_line": 205, + "search_value": "", + "expected_value": "Attribute 'serverSideEncryption' should be defined", + "actual_value": "Attribute 'serverSideEncryption' is not defined" + } + ] + }, + { + "query_name": "Passwords And Secrets - Generic Password", + "query_id": "487f4be7-3fd9-4506-a07a-eae252180c08", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "1d73d5dae3d1a4824830f1a423473d36b79973a15ca9d23f1348c3dc8a30c7e4", + "line": 16, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "EC2 Instance Monitoring Disabled", + "query_id": "daa581ef-731c-4121-832d-cf078f67759d", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#monitoring_yaml", + "severity": "MEDIUM", + "platform": "Pulumi", + "cwe": "778", + "risk_score": "5.1", + "cloud_provider": "AWS", + "category": "Observability", + "experimental": false, + "description": "EC2 Instance should have detailed monitoring enabled. With detailed monitoring enabled data is available in 1-minute periods", + "description_id": "7f96d3ac", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "4d692568cdae89e9d5e0ebef040401e6b922b9ac9a51a09554ba9629b730ad7c", + "line": 157, + "resource_type": "aws:ec2:Instance", + "resource_name": "Unencrypted Instance", + "issue_type": "MissingAttribute", + "search_key": "resources[unencryptedInstance].properties", + "search_line": 157, + "search_value": "", + "expected_value": "Attribute 'monitoring' should be defined and set to true", + "actual_value": "Attribute 'monitoring' is not defined" + } + ] + }, + { + "query_name": "DynamoDB Table Point In Time Recovery Disabled", + "query_id": "327b0729-4c5c-4c44-8b5c-e476cd9c7290", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#pointintimerecovery_yaml", + "severity": "INFO", + "platform": "Pulumi", + "cwe": "459", + "risk_score": "0.0", + "cloud_provider": "AWS", + "category": "Best Practices", + "experimental": false, + "description": "It's considered a best practice to have point in time recovery enabled for DynamoDB Table", + "description_id": "6ff56c6e", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "7b5c72142600d0995c06ae3634f4776b5565be2c0323d509b9b51e9d915b03e8", + "line": 213, + "resource_type": "aws:dynamodb:Table", + "resource_name": "Unencrypted Table", + "issue_type": "IncorrectValue", + "search_key": "resources[unencryptedTable].properties.pointInTimeRecovery.enabled", + "search_line": 213, + "search_value": "", + "expected_value": "Attribute 'enabled' in 'pointInTimeRecovery' should be set to true", + "actual_value": "Attribute 'enabled' in 'pointInTimeRecovery' is set to false" + } + ] + }, + { + "query_name": "EC2 Not EBS Optimized", + "query_id": "d991e4ae-42ab-429b-ab43-d5e5fa9ca633", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#ebsoptimized_yaml", + "severity": "INFO", + "platform": "Pulumi", + "cwe": "459", + "risk_score": "0.0", + "cloud_provider": "AWS", + "category": "Best Practices", + "experimental": false, + "description": "It's considered a best practice for an EC2 instance to use an EBS optimized instance. This provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I/O and other traffic from your instance", + "description_id": "81a001dd", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "9d46c3011c910cf43e7d99575a291f05b1b4f701f62e99c132837e16f7ee27a4", + "line": 157, + "resource_type": "aws:ec2:Instance", + "resource_name": "unencryptedInstance", + "issue_type": "MissingAttribute", + "search_key": "resources[unencryptedInstance].properties", + "search_line": 157, + "search_value": "", + "expected_value": "Attribute 'ebsOptimized' should be defined and set to true", + "actual_value": "Attribute 'ebsOptimized' is not defined" + } + ] + } + ] +} diff --git a/labs/lab6/analysis/pulumi-analysis.txt b/labs/lab6/analysis/pulumi-analysis.txt new file mode 100644 index 00000000..372ce46d --- /dev/null +++ b/labs/lab6/analysis/pulumi-analysis.txt @@ -0,0 +1,5 @@ +=== Pulumi Security Analysis (KICS) === +KICS Pulumi findings: 6 + HIGH severity: 2 + MEDIUM severity: 1 + LOW severity: 0 diff --git a/labs/lab6/analysis/terraform-comparison.txt b/labs/lab6/analysis/terraform-comparison.txt new file mode 100644 index 00000000..7d2f4695 --- /dev/null +++ b/labs/lab6/analysis/terraform-comparison.txt @@ -0,0 +1,4 @@ +=== Terraform Security Analysis === +tfsec findings: 53 +Checkov findings: 78 +Terrascan findings: 22 diff --git a/labs/lab6/analysis/terrascan-report.txt b/labs/lab6/analysis/terrascan-report.txt new file mode 100644 index 00000000..e69de29b diff --git a/labs/lab6/analysis/terrascan-results.json b/labs/lab6/analysis/terrascan-results.json new file mode 100644 index 00000000..e69de29b diff --git a/labs/lab6/analysis/tfsec-report.txt b/labs/lab6/analysis/tfsec-report.txt new file mode 100644 index 00000000..e69de29b diff --git a/labs/lab6/analysis/tfsec-results.json b/labs/lab6/analysis/tfsec-results.json new file mode 100644 index 00000000..e69de29b diff --git a/labs/lab6/analysis/tool-comparison.txt b/labs/lab6/analysis/tool-comparison.txt new file mode 100644 index 00000000..22ee5ab1 --- /dev/null +++ b/labs/lab6/analysis/tool-comparison.txt @@ -0,0 +1,9 @@ +=== Comprehensive Tool Comparison === + +Terraform Scanning Results: + - tfsec: 53 findings + - Checkov: 78 findings + - Terrascan: 22 findings + +Pulumi Scanning Results (KICS): 6 findings +Ansible Scanning Results (KICS): 10 findings diff --git a/labs/submission6.md b/labs/submission6.md new file mode 100644 index 00000000..bf955d1b --- /dev/null +++ b/labs/submission6.md @@ -0,0 +1,175 @@ +# Lab 6 — Infrastructure-as-Code Security: Scanning & Policy Enforcement + +## Scope + +This lab analyzes intentionally vulnerable Infrastructure-as-Code in: +- Terraform +- Pulumi +- Ansible + +Tools used: +- tfsec +- Checkov +- Terrascan +- KICS + +--- + +# Task 1 — Terraform & Pulumi Security Scanning + +## Terraform Tool Comparison + +Terraform was scanned with three tools. + +| Tool | Findings | +|-----|------| +| tfsec | 53 | +| Checkov | 78 | +| Terrascan | 22 | + +Observations: + +- **tfsec** performs fast Terraform-specific checks with low configuration overhead. +- **Checkov** detects the largest number of issues due to its large policy library. +- **Terrascan** focuses more on compliance-style policy validation. + +Checkov detected the highest number of misconfigurations due to its extensive ruleset. + +--- + +## Pulumi Security Analysis + +Pulumi infrastructure was scanned using **KICS**. + +Results: + +| Severity | Findings | +|--------|--------| +| Critical | 1 | +| High | 2 | +| Medium | 1 | +| Low | 0 | +| Info | 2 | +| **Total** | **6** | + +Example vulnerabilities detected: + +1. Public RDS database instance +2. DynamoDB table without encryption +3. Hardcoded password in configuration +4. EC2 monitoring disabled +5. DynamoDB point-in-time recovery disabled + +These findings show common infrastructure misconfiguration issues such as missing encryption, exposed resources, and insecure credentials. + +--- + +## Terraform vs Pulumi + +Both Terraform and Pulumi configurations contained similar security risks: + +- publicly accessible cloud resources +- missing encryption +- weak network restrictions +- insecure credentials + +Terraform scanning tools provided deeper HCL-specific analysis, while KICS provided unified scanning across multiple IaC frameworks. + +--- + +## Critical Findings + +Top 5 critical infrastructure security problems identified: + +1. Public RDS database instance +2. Public S3 bucket exposure +3. Security groups allowing `0.0.0.0/0` +4. Unencrypted storage resources +5. Hardcoded credentials + +Recommended remediation: + +- enable encryption for storage and databases +- restrict network access +- remove hardcoded secrets +- enforce least-privilege IAM policies + +--- + +# Task 2 — Ansible Security Scanning + +Ansible playbooks were scanned using **KICS**. + +Results: + +| Severity | Findings | +|--------|--------| +| High | 9 | +| Medium | 0 | +| Low | 1 | +| **Total** | **10** | + +Common security issues detected: + +- hardcoded credentials +- insecure command execution +- missing log protection for sensitive operations + +Best practice violations: + +1. Hardcoded passwords in configuration +2. Missing `no_log: true` in sensitive tasks +3. Insecure shell command usage + +Remediation: + +- store secrets using **Ansible Vault** +- protect sensitive tasks with `no_log` +- use Ansible modules instead of raw shell commands + +--- + +# Task 3 — Comparative Tool Analysis + +## Tool Comparison Matrix + +| Criterion | tfsec | Checkov | Terrascan | KICS | +|-----------|-------|---------|-----------|------| +| Total Findings | 53 | 78 | 22 | 16 | +| Scan Speed | Fast | Medium | Medium | Medium | +| Ease of Use | Easy | Easy | Medium | Medium | +| Documentation | Good | Excellent | Good | Good | +| Platform Support | Terraform | Multi-IaC | Multi-IaC | Multi-IaC | +| CI/CD Integration | Easy | Easy | Medium | Easy | + +--- + +## Category Analysis + +| Security Category | Best Tool | +|------------------|-----------| +| Encryption issues | Checkov | +| Network security | tfsec | +| Secrets detection | KICS | +| IAM / permissions | Checkov | +| Compliance checks | Terrascan | + +--- + +## Lessons Learned + +Running multiple IaC security scanners improves coverage and reduces blind spots. + +Terraform-specific tools provide deep infrastructure validation, while multi-framework scanners such as KICS enable consistent security checks across Pulumi and Ansible configurations. + +--- + +## CI/CD Integration Strategy + +Recommended pipeline: + +1. **PR checks** — tfsec + Checkov +2. **Nightly scans** — Terrascan compliance validation +3. **Multi-IaC scanning** — KICS for Pulumi and Ansible + +This layered approach provides fast feedback and comprehensive infrastructure security validation.