From 888a19cfafcbc5b55b4e6b58db3ea50fdc2bcb2a Mon Sep 17 00:00:00 2001 From: Rashid Badamshin Date: Sun, 8 Feb 2026 17:17:38 +0300 Subject: [PATCH 01/15] add template --- labs/.github/pull_request_template.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 labs/.github/pull_request_template.md diff --git a/labs/.github/pull_request_template.md b/labs/.github/pull_request_template.md new file mode 100644 index 00000000..b096b147 --- /dev/null +++ b/labs/.github/pull_request_template.md @@ -0,0 +1,23 @@ +## Goal + + + +## Changes + + + +## Testing + + + +## Artifacts & Screenshots + + + +--- + +### Checklist + +- [ ] Clear, descriptive title +- [ ] Documentation updated if needed +- [ ] No secrets or large temp files committed From 81b28c3669fa3e1ac5a2c5628a2bfcba8824e81c Mon Sep 17 00:00:00 2001 From: Rashid Badamshin Date: Sun, 8 Feb 2026 17:20:47 +0300 Subject: [PATCH 02/15] docs: add lab1 submission --- labs/submission1.md | 118 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 labs/submission1.md diff --git a/labs/submission1.md b/labs/submission1.md new file mode 100644 index 00000000..03c9a2e4 --- /dev/null +++ b/labs/submission1.md @@ -0,0 +1,118 @@ +# Triage Report — OWASP Juice Shop + +> **Before submitting:** Run these commands, then paste outputs and complete checkboxes below: +> 1. `docker run -d --name juice-shop -p 127.0.0.1:3000:3000 bkimminich/juice-shop:v19.0.0` +> 2. Browse to http://localhost:3000 and take a screenshot → save as `labs/screenshots/juice-shop-home.png` +> 3. `curl -s http://127.0.0.1:3000/rest/products | head` → paste output in Health Check +> 4. `curl -I http://127.0.0.1:3000` → check for CSP/HSTS in Surface Snapshot + +## Scope & Asset + +- Asset: OWASP Juice Shop (local lab instance) +- Image: bkimminich/juice-shop:v19.0.0 +- Release link/date: [v19.0.0 Release](https://github.com/juice-shop/juice-shop/releases/tag/v19.0.0) — 2025-09-04 +- Image digest: sha256:37cc73163c4c269c044e890fee868d62637109cad126a26dab13dc442ef2ae76 + +## Environment + +- Host OS: Linux 6.8.0-58-generic +- Docker: 26.1.3, build 26.1.3-0ubuntu1~24.04.1 + +## Deployment Details + +- Run command used: `docker run -d --name juice-shop -p 127.0.0.1:3000:3000 bkimminich/juice-shop:v19.0.0` +- Access URL: http://127.0.0.1:3000 +- Network exposure: 127.0.0.1 only [x] Yes [ ] No _(bound to localhost only)_ + +## Health Check + +- Page load: + - **Screenshot path:** `labs/screenshots/juice-shop-home.png` _ +- API check: Output from `curl -s http://127.0.0.1:3000/rest/products | head`: + +``` + + + + Error: Unexpected path: /rest/products + + + +

+ + + ZAP Authenticated Safe Scan Report +

+

+ + +

+ + Site: http://localhost:3000 + +

+ +

+ Generated on Sun, 8 Mar 2026 13:42:43 +

+ +

+ ZAP Version: 2.17.0 +

+ +

+ ZAP by Checkmarx +

+ + +

Summary of Alerts

+ + + + + + + + + + + + + + + + + + + + + + + + + +
Risk LevelNumber of Alerts
+
High
+ 		+
0
+
+
Medium
+ 		+
2
+
+
Low
+ 		+
3
+
+
Informational
+ 		+
3
+
+
False Positives:
+ 		+
0
+
+
+ + + +

Insights

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
LevelReasonSiteDescriptionStatistic
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of responses with status code 2xx
+ 		+
69 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of responses with status code 4xx
+ 		+
8 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of responses with status code 5xx
+ 		+
22 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type application/json
+ 		+
2 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type application/octet-stream
+ 		+
12 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type text/html
+ 		+
74 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type text/markdown
+ 		+
7 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type text/plain
+ 		+
2 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with method GET
+ 		+
97 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with method POST
+ 		+
2 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Count of total endpoints
+ 		+
39
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of slow responses
+ 		+
3 %
+
+
+ + + + +

Summary of Sequences

+

For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any).

+ + + + + + + + +

Alerts

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameRisk LevelNumber of Instances
Content Security Policy (CSP) Header Not SetMediumSystemic
Cross-Domain MisconfigurationMediumSystemic
Application Error DisclosureLow3
Cross-Domain JavaScript Source File InclusionLowSystemic
Timestamp Disclosure - UnixLowSystemic
Authentication Request IdentifiedInformational1
Modern Web ApplicationInformationalSystemic
Session Management Response IdentifiedInformational1
+
+ + + +

Alert Detail

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Medium
Content Security Policy (CSP) Header Not Set
Description +
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/ftp/eastere.gg
Node Namehttp://localhost:3000/ftp/eastere.gg
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/rest
Node Namehttp://localhost:3000/rest
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/rest/user
Node Namehttp://localhost:3000/rest/user
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/rest/user/login
Node Namehttp://localhost:3000/rest/user/login
MethodGET
Parameter
Attack
Evidence
Other Info
InstancesSystemic
Solution +
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP +
+ + https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html +
+ + https://www.w3.org/TR/CSP/ +
+ + https://w3c.github.io/webappsec-csp/ +
+ + https://web.dev/articles/csp +
+ + https://caniuse.com/#feat=contentsecuritypolicy +
+ + https://content-security-policy.com/ + +
CWE Id693
WASC Id15
Plugin Id10038
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Medium
Cross-Domain Misconfiguration
Description +
Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.
+ +
URLhttp://localhost:3000/rest
Node Namehttp://localhost:3000/rest
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/rest/user
Node Namehttp://localhost:3000/rest/user
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/rest/user/login
Node Namehttp://localhost:3000/rest/user/login
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/robots.txt
Node Namehttp://localhost:3000/robots.txt
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/rest/user/login
Node Namehttp://localhost:3000/rest/user/login ()({email,password})
MethodPOST
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
InstancesSystemic
Solution +
Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance).
+
+ +
Configure the "Access-Control-Allow-Origin" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.
+ +
Reference + https://vulncat.fortify.com/en/detail?category=HTML5&subcategory=Overly%20Permissive%20CORS%20Policy + +
CWE Id264
WASC Id14
Plugin Id10098
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Application Error Disclosure
Description +
This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.
+ +
URLhttp://localhost:3000/rest
Node Namehttp://localhost:3000/rest
MethodGET
Parameter
Attack
EvidenceHTTP/1.1 500 Internal Server Error
Other Info
URLhttp://localhost:3000/rest/user
Node Namehttp://localhost:3000/rest/user
MethodGET
Parameter
Attack
EvidenceHTTP/1.1 500 Internal Server Error
Other Info
URLhttp://localhost:3000/rest/user/login
Node Namehttp://localhost:3000/rest/user/login
MethodGET
Parameter
Attack
EvidenceHTTP/1.1 500 Internal Server Error
Other Info
Instances3
Solution +
Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.
+ +
Reference
CWE Id550
WASC Id13
Plugin Id90022
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Cross-Domain JavaScript Source File Inclusion
Description +
The page includes one or more script files from a third-party domain.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
URLhttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
Node Namehttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
Node Namehttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
InstancesSystemic
Solution +
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
+ +
Reference
CWE Id829
WASC Id15
Plugin Id10017
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Timestamp Disclosure - Unix
Description +
A timestamp was disclosed by the application/web server. - Unix
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidence1650485437
Other Info1650485437, which evaluates to: 2022-04-20 20:10:37.
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidence1981395349
Other Info1981395349, which evaluates to: 2032-10-14 19:35:49.
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidence2038834951
Other Info2038834951, which evaluates to: 2034-08-10 15:02:31.
URLhttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
Node Namehttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
MethodGET
Parameter
Attack
Evidence1650485437
Other Info1650485437, which evaluates to: 2022-04-20 20:10:37.
URLhttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
Node Namehttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
MethodGET
Parameter
Attack
Evidence2038834951
Other Info2038834951, which evaluates to: 2034-08-10 15:02:31.
InstancesSystemic
Solution +
Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
+ +
Reference + https://cwe.mitre.org/data/definitions/200.html + +
CWE Id497
WASC Id13
Plugin Id10096
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Authentication Request Identified
Description +
The given request has been identified as an authentication request. The 'Other Info' field contains a set of key=value lines which identify any relevant fields. If the request is in a context which has an Authentication Method set to "Auto-Detect" then this rule will change the authentication to match the request identified.
+ +
URLhttp://localhost:3000/rest/user/login
Node Namehttp://localhost:3000/rest/user/login ()({email,password})
MethodPOST
Parameteremail
Attack
Evidencepassword
Other InfouserParam=email +userValue=admin@juice-sh.op +passwordParam=password
Instances1
Solution +
This is an informational alert rather than a vulnerability and so there is nothing to fix.
+ +
Reference + https://www.zaproxy.org/docs/desktop/addons/authentication-helper/auth-req-id/ + +
CWE Id
WASC Id
Plugin Id10111
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Modern Web Application
Description +
The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://localhost:3000/ftp/
Node Namehttp://localhost:3000/ftp/
MethodGET
Parameter
Attack
Evidence<a href="">ftp</a>
Other InfoLinks have been found that do not have traditional href attributes, which is an indication that this is a modern web application.
URLhttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
Node Namehttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:328:13
Node Namehttp://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:328:13
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
InstancesSystemic
Solution +
This is an informational alert and so no changes are required.
+ +
Reference
CWE Id
WASC Id
Plugin Id10109
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Session Management Response Identified
Description +
The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to "Auto-Detect" then this rule will change the session management to use the tokens identified.
+ +
URLhttp://localhost:3000/rest/user/login
Node Namehttp://localhost:3000/rest/user/login ()({email,password})
MethodPOST
Parameterauthentication.token
Attack
Evidenceauthentication.token
Other Infojson:authentication.token
Instances1
Solution +
This is an informational alert rather than a vulnerability and so there is nothing to fix.
+ +
Reference + https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id/ + +
CWE Id
WASC Id
Plugin Id10112
+
+ + + + + +

Sequence Details

+ With the associated active scan results. + + + +
+ + + + + + + diff --git a/labs/lab5/zap/report-noauth.html b/labs/lab5/zap/report-noauth.html new file mode 100644 index 00000000..fbbd6211 --- /dev/null +++ b/labs/lab5/zap/report-noauth.html @@ -0,0 +1,3226 @@ + + + + +ZAP Scanning Report + + + +

+ + + ZAP Scanning Report +

+

+ + +

+ + Site: http://localhost:3000 + +

+ +

+ Generated on Sun, 8 Mar 2026 13:25:10 +

+ +

+ ZAP Version: 2.17.0 +

+ +

+ ZAP by Checkmarx +

+ + +

Summary of Alerts

+ + + + + + + + + + + + + + + + + + + + + + + + + +
Risk LevelNumber of Alerts
+
High
+ 		+
0
+
+
Medium
+ 		+
2
+
+
Low
+ 		+
6
+
+
Informational
+ 		+
4
+
+
False Positives:
+ 		+
0
+
+
+ + + +

Insights

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
LevelReasonSiteDescriptionStatistic
+
Low
+ 		+
Warning
+ 		+
+ 		+
ZAP warnings logged - see the zap.log file for details
+ 		+
1
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of responses with status code 2xx
+ 		+
91 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of responses with status code 4xx
+ 		+
8 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type application/javascript
+ 		+
5 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type application/octet-stream
+ 		+
6 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type image/x-icon
+ 		+
1 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type text/css
+ 		+
1 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type text/html
+ 		+
79 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type text/markdown
+ 		+
4 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with content type text/plain
+ 		+
1 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of endpoints with method GET
+ 		+
100 %
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Count of total endpoints
+ 		+
72
+
+
Info
+ 		+
Informational
+ 		+
http://localhost:3000
+ 		+
Percentage of slow responses
+ 		+
45 %
+
+
+ + + + +

Summary of Sequences

+

For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any).

+ + + + + + + + +

Alerts

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameRisk LevelNumber of Instances
Content Security Policy (CSP) Header Not SetMediumSystemic
Cross-Domain MisconfigurationMediumSystemic
Cross-Domain JavaScript Source File InclusionLowSystemic
Cross-Origin-Embedder-Policy Header Missing or InvalidLowSystemic
Cross-Origin-Opener-Policy Header Missing or InvalidLowSystemic
Dangerous JS FunctionsLow2
Deprecated Feature Policy Header SetLowSystemic
Timestamp Disclosure - UnixLowSystemic
Modern Web ApplicationInformationalSystemic
Non-Storable ContentInformational2
Storable and Cacheable ContentInformational1
Storable but Non-Cacheable ContentInformationalSystemic
+
+ + + +

Alert Detail

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Medium
Content Security Policy (CSP) Header Not Set
Description +
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/ftp/eastere.gg
Node Namehttp://localhost:3000/ftp/eastere.gg
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/ftp/encrypt.pyc
Node Namehttp://localhost:3000/ftp/encrypt.pyc
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/ftp/package-lock.json.bak
Node Namehttp://localhost:3000/ftp/package-lock.json.bak
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence
Other Info
InstancesSystemic
Solution +
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP +
+ + https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html +
+ + https://www.w3.org/TR/CSP/ +
+ + https://w3c.github.io/webappsec-csp/ +
+ + https://web.dev/articles/csp +
+ + https://caniuse.com/#feat=contentsecuritypolicy +
+ + https://content-security-policy.com/ + +
CWE Id693
WASC Id15
Plugin Id10038
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Medium
Cross-Domain Misconfiguration
Description +
Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.
+ +
URLhttp://localhost:3000/assets/public/favicon_js.ico
Node Namehttp://localhost:3000/assets/public/favicon_js.ico
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/polyfills.js
Node Namehttp://localhost:3000/polyfills.js
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/robots.txt
Node Namehttp://localhost:3000/robots.txt
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/runtime.js
Node Namehttp://localhost:3000/runtime.js
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://localhost:3000/styles.css
Node Namehttp://localhost:3000/styles.css
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
InstancesSystemic
Solution +
Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance).
+
+ +
Configure the "Access-Control-Allow-Origin" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.
+ +
Reference + https://vulncat.fortify.com/en/detail?category=HTML5&subcategory=Overly%20Permissive%20CORS%20Policy + +
CWE Id264
WASC Id14
Plugin Id10098
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Cross-Domain JavaScript Source File Inclusion
Description +
The page includes one or more script files from a third-party domain.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
URLhttp://localhost:3000/
Node Namehttp://localhost:3000/
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
InstancesSystemic
Solution +
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
+ +
Reference
CWE Id829
WASC Id15
Plugin Id10017
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Cross-Origin-Embedder-Policy Header Missing or Invalid
Description +
Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/ftp
Node Namehttp://localhost:3000/ftp
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/juice-shop/build/routes/fileServer.js:43:13
Node Namehttp://localhost:3000/juice-shop/build/routes/fileServer.js:43:13
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/juice-shop/build/routes/fileServer.js:59:18
Node Namehttp://localhost:3000/juice-shop/build/routes/fileServer.js:59:18
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
InstancesSystemic
Solution +
Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.
+
+ +
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy + +
CWE Id693
WASC Id14
Plugin Id90004
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Cross-Origin-Opener-Policy Header Missing or Invalid
Description +
Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/ftp
Node Namehttp://localhost:3000/ftp
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/juice-shop/build/routes/fileServer.js:43:13
Node Namehttp://localhost:3000/juice-shop/build/routes/fileServer.js:43:13
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/juice-shop/build/routes/fileServer.js:59:18
Node Namehttp://localhost:3000/juice-shop/build/routes/fileServer.js:59:18
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
InstancesSystemic
Solution +
Ensure that the application/web server sets the Cross-Origin-Opener-Policy header appropriately, and that it sets the Cross-Origin-Opener-Policy header to 'same-origin' for documents.
+
+ +
'same-origin-allow-popups' is considered as less secured and should be avoided.
+
+ +
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Opener-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-opener-policy).
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy + +
CWE Id693
WASC Id14
Plugin Id90004
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Dangerous JS Functions
Description +
A dangerous JS function seems to be in use that would leave the site vulnerable.
+ +
URLhttp://localhost:3000/main.js
Node Namehttp://localhost:3000/main.js
MethodGET
Parameter
Attack
EvidencebypassSecurityTrustHtml(
Other Info
URLhttp://localhost:3000/vendor.js
Node Namehttp://localhost:3000/vendor.js
MethodGET
Parameter
Attack
EvidencebypassSecurityTrustHtml(
Other Info
Instances2
Solution +
See the references for security advice on the use of these functions.
+ +
Reference + https://v17.angular.io/guide/security + +
CWE Id749
WASC Id
Plugin Id10110
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Deprecated Feature Policy Header Set
Description +
The header has now been renamed to Permissions-Policy.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://localhost:3000/main.js
Node Namehttp://localhost:3000/main.js
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://localhost:3000/polyfills.js
Node Namehttp://localhost:3000/polyfills.js
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://localhost:3000/runtime.js
Node Namehttp://localhost:3000/runtime.js
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
InstancesSystemic
Solution +
Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy +
+ + https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/ + +
CWE Id16
WASC Id15
Plugin Id10063
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Timestamp Disclosure - Unix
Description +
A timestamp was disclosed by the application/web server. - Unix
+ +
URLhttp://localhost:3000/styles.css
Node Namehttp://localhost:3000/styles.css
MethodGET
Parameter
Attack
Evidence1680327869
Other Info1680327869, which evaluates to: 2023-04-01 05:44:29.
URLhttp://localhost:3000/styles.css
Node Namehttp://localhost:3000/styles.css
MethodGET
Parameter
Attack
Evidence1701244813
Other Info1701244813, which evaluates to: 2023-11-29 08:00:13.
URLhttp://localhost:3000/styles.css
Node Namehttp://localhost:3000/styles.css
MethodGET
Parameter
Attack
Evidence1839622642
Other Info1839622642, which evaluates to: 2028-04-17 22:17:22.
URLhttp://localhost:3000/styles.css
Node Namehttp://localhost:3000/styles.css
MethodGET
Parameter
Attack
Evidence1863874346
Other Info1863874346, which evaluates to: 2029-01-23 14:52:26.
URLhttp://localhost:3000/styles.css
Node Namehttp://localhost:3000/styles.css
MethodGET
Parameter
Attack
Evidence2033195021
Other Info2033195021, which evaluates to: 2034-06-06 08:23:41.
InstancesSystemic
Solution +
Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
+ +
Reference + https://cwe.mitre.org/data/definitions/200.html + +
CWE Id497
WASC Id13
Plugin Id10096
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Modern Web Application
Description +
The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://localhost:3000/
Node Namehttp://localhost:3000/
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://localhost:3000/juice-shop/build/routes/fileServer.js:43:13
Node Namehttp://localhost:3000/juice-shop/build/routes/fileServer.js:43:13
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://localhost:3000/juice-shop/build/routes/fileServer.js:59:18
Node Namehttp://localhost:3000/juice-shop/build/routes/fileServer.js:59:18
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://localhost:3000/sitemap.xml
Node Namehttp://localhost:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
InstancesSystemic
Solution +
This is an informational alert and so no changes are required.
+ +
Reference
CWE Id
WASC Id
Plugin Id10109
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Non-Storable Content
Description +
The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
+ +
URLhttp://localhost:3000/ftp/eastere.gg
Node Namehttp://localhost:3000/ftp/eastere.gg
MethodGET
Parameter
Attack
Evidence403
Other Info
URLhttp://localhost:3000/ftp/encrypt.pyc
Node Namehttp://localhost:3000/ftp/encrypt.pyc
MethodGET
Parameter
Attack
Evidence403
Other Info
Instances2
Solution +
The content may be marked as storable by ensuring that the following conditions are satisfied:
+
+ +
The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable)
+
+ +
The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)
+
+ +
The "no-store" cache directive must not appear in the request or response header fields
+
+ +
For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response
+
+ +
For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives)
+
+ +
In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:
+
+ +
It must contain an "Expires" header field
+
+ +
It must contain a "max-age" response directive
+
+ +
For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive
+
+ +
It must contain a "Cache Control Extension" that allows it to be cached
+
+ +
It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).
+ +
Reference + https://datatracker.ietf.org/doc/html/rfc7234 +
+ + https://datatracker.ietf.org/doc/html/rfc7231 +
+ + https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html + +
CWE Id524
WASC Id13
Plugin Id10049
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Storable and Cacheable Content
Description +
The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where "shared" caching servers such as "proxy" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
+ +
URLhttp://localhost:3000/robots.txt
Node Namehttp://localhost:3000/robots.txt
MethodGET
Parameter
Attack
Evidence
Other InfoIn the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
Instances1
Solution +
Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
+
+ +
Cache-Control: no-cache, no-store, must-revalidate, private
+
+ +
Pragma: no-cache
+
+ +
Expires: 0
+
+ +
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
+ +
Reference + https://datatracker.ietf.org/doc/html/rfc7234 +
+ + https://datatracker.ietf.org/doc/html/rfc7231 +
+ + https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html + +
CWE Id524
WASC Id13
Plugin Id10049
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Storable but Non-Cacheable Content
Description +
The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
+ +
URLhttp://localhost:3000
Node Namehttp://localhost:3000
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://localhost:3000/assets/public/favicon_js.ico
Node Namehttp://localhost:3000/assets/public/favicon_js.ico
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://localhost:3000/polyfills.js
Node Namehttp://localhost:3000/polyfills.js
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://localhost:3000/runtime.js
Node Namehttp://localhost:3000/runtime.js
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://localhost:3000/styles.css
Node Namehttp://localhost:3000/styles.css
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
InstancesSystemic
Solution
Reference + https://datatracker.ietf.org/doc/html/rfc7234 +
+ + https://datatracker.ietf.org/doc/html/rfc7231 +
+ + https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html + +
CWE Id524
WASC Id13
Plugin Id10049
+
+ + + + + +

Sequence Details

+ With the associated active scan results. + + + +
+ + + + + + + diff --git a/labs/lab5/zap/zap-report-auth.json b/labs/lab5/zap/zap-report-auth.json new file mode 100644 index 00000000..96a7c499 --- /dev/null +++ b/labs/lab5/zap/zap-report-auth.json @@ -0,0 +1,577 @@ +{ + "@programName": "ZAP", + "@version": "2.17.0", + "@generated": "Sun, 8 Mar 2026 13:42:43", + "created": "2026-03-08T13:42:43.617686037Z", + "insights":[ + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.code.2xx", + "description": "Percentage of responses with status code 2xx", + "statistic": "69" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.code.4xx", + "description": "Percentage of responses with status code 4xx", + "statistic": "8" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.code.5xx", + "description": "Percentage of responses with status code 5xx", + "statistic": "22" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.application/json", + "description": "Percentage of endpoints with content type application/json", + "statistic": "2" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.application/octet-stream", + "description": "Percentage of endpoints with content type application/octet-stream", + "statistic": "12" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/html", + "description": "Percentage of endpoints with content type text/html", + "statistic": "74" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/markdown", + "description": "Percentage of endpoints with content type text/markdown", + "statistic": "7" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/plain", + "description": "Percentage of endpoints with content type text/plain", + "statistic": "2" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.method.GET", + "description": "Percentage of endpoints with method GET", + "statistic": "97" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.method.POST", + "description": "Percentage of endpoints with method POST", + "statistic": "2" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.total", + "description": "Count of total endpoints", + "statistic": "39" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.response.slow", + "description": "Percentage of slow responses", + "statistic": "3" + } + ], + "site":[ + { + "@name": "http://localhost:3000", + "@host": "localhost", + "@port": "3000", + "@ssl": "false", + "alerts": [ + { + "pluginid": "10038", + "alertRef": "10038-1", + "alert": "Content Security Policy (CSP) Header Not Set", + "name": "Content Security Policy (CSP) Header Not Set", + "riskcode": "2", + "confidence": "3", + "riskdesc": "Medium (High)", + "desc": "

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page \u2014 covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

", + "instances":[ + { + "id": "19", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "40", + "uri": "http://localhost:3000/ftp/eastere.gg", + "nodeName": "http:\/\/localhost:3000\/ftp\/eastere.gg", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "16", + "uri": "http://localhost:3000/rest", + "nodeName": "http:\/\/localhost:3000\/rest", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "13", + "uri": "http://localhost:3000/rest/user", + "nodeName": "http:\/\/localhost:3000\/rest\/user", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "14", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.

", + "otherinfo": "", + "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

https://www.w3.org/TR/CSP/

https://w3c.github.io/webappsec-csp/

https://web.dev/articles/csp

https://caniuse.com/#feat=contentsecuritypolicy

https://content-security-policy.com/

", + "cweid": "693", + "wascid": "15", + "sourceid": "9" + }, + { + "pluginid": "10098", + "alertRef": "10098", + "alert": "Cross-Domain Misconfiguration", + "name": "Cross-Domain Misconfiguration", + "riskcode": "2", + "confidence": "2", + "riskdesc": "Medium (Medium)", + "desc": "

Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.

", + "instances":[ + { + "id": "18", + "uri": "http://localhost:3000/rest", + "nodeName": "http:\/\/localhost:3000\/rest", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "15", + "uri": "http://localhost:3000/rest/user", + "nodeName": "http:\/\/localhost:3000\/rest\/user", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "17", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "10", + "uri": "http://localhost:3000/robots.txt", + "nodeName": "http:\/\/localhost:3000\/robots.txt", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "2", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login ()({email,password})", + "method": "POST", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance).

Configure the \"Access-Control-Allow-Origin\" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.

", + "otherinfo": "

The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.

", + "reference": "

https://vulncat.fortify.com/en/detail?category=HTML5&subcategory=Overly%20Permissive%20CORS%20Policy

", + "cweid": "264", + "wascid": "14", + "sourceid": "19" + }, + { + "pluginid": "90022", + "alertRef": "90022", + "alert": "Application Error Disclosure", + "name": "Application Error Disclosure", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.

", + "instances":[ + { + "id": "11", + "uri": "http://localhost:3000/rest", + "nodeName": "http:\/\/localhost:3000\/rest", + "method": "GET", + "param": "", + "attack": "", + "evidence": "HTTP/1.1 500 Internal Server Error", + "otherinfo": "" + }, + { + "id": "12", + "uri": "http://localhost:3000/rest/user", + "nodeName": "http:\/\/localhost:3000\/rest\/user", + "method": "GET", + "param": "", + "attack": "", + "evidence": "HTTP/1.1 500 Internal Server Error", + "otherinfo": "" + }, + { + "id": "9", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login", + "method": "GET", + "param": "", + "attack": "", + "evidence": "HTTP/1.1 500 Internal Server Error", + "otherinfo": "" + } + ], + "count": "3", + "systemic": false, + "solution": "

Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.

", + "otherinfo": "", + "reference": "", + "cweid": "550", + "wascid": "13", + "sourceid": "19" + }, + { + "pluginid": "10017", + "alertRef": "10017", + "alert": "Cross-Domain JavaScript Source File Inclusion", + "name": "Cross-Domain JavaScript Source File Inclusion", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The page includes one or more script files from a third-party domain.

", + "instances":[ + { + "id": "21", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "22", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "96", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:280:10", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "98", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:280:10", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "99", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.

", + "otherinfo": "", + "reference": "", + "cweid": "829", + "wascid": "15", + "sourceid": "9" + }, + { + "pluginid": "10096", + "alertRef": "10096", + "alert": "Timestamp Disclosure - Unix", + "name": "Timestamp Disclosure - Unix", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "

A timestamp was disclosed by the application/web server. - Unix

", + "instances":[ + { + "id": "24", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1650485437", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37." + }, + { + "id": "26", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1981395349", + "otherinfo": "1981395349, which evaluates to: 2032-10-14 19:35:49." + }, + { + "id": "25", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2038834951", + "otherinfo": "2038834951, which evaluates to: 2034-08-10 15:02:31." + }, + { + "id": "103", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:280:10", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1650485437", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37." + }, + { + "id": "104", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:280:10", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2038834951", + "otherinfo": "2038834951, which evaluates to: 2034-08-10 15:02:31." + } + ], + "count": "5", + "systemic": true, + "solution": "

Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

", + "otherinfo": "

1650485437, which evaluates to: 2022-04-20 20:10:37.

", + "reference": "

https://cwe.mitre.org/data/definitions/200.html

", + "cweid": "497", + "wascid": "13", + "sourceid": "9" + }, + { + "pluginid": "10111", + "alertRef": "10111", + "alert": "Authentication Request Identified", + "name": "Authentication Request Identified", + "riskcode": "0", + "confidence": "3", + "riskdesc": "Informational (High)", + "desc": "

The given request has been identified as an authentication request. The 'Other Info' field contains a set of key=value lines which identify any relevant fields. If the request is in a context which has an Authentication Method set to \"Auto-Detect\" then this rule will change the authentication to match the request identified.

", + "instances":[ + { + "id": "0", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login ()({email,password})", + "method": "POST", + "param": "email", + "attack": "", + "evidence": "password", + "otherinfo": "userParam=email\nuserValue=admin@juice-sh.op\npasswordParam=password" + } + ], + "count": "1", + "systemic": false, + "solution": "

This is an informational alert rather than a vulnerability and so there is nothing to fix.

", + "otherinfo": "

userParam=email

userValue=admin@juice-sh.op

passwordParam=password

", + "reference": "

https://www.zaproxy.org/docs/desktop/addons/authentication-helper/auth-req-id/

", + "cweid": "-1", + "wascid": "-1", + "sourceid": "3" + }, + { + "pluginid": "10109", + "alertRef": "10109", + "alert": "Modern Web Application", + "name": "Modern Web Application", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.

", + "instances":[ + { + "id": "23", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "84", + "uri": "http://localhost:3000/ftp/", + "nodeName": "http:\/\/localhost:3000\/ftp\/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "ftp", + "otherinfo": "Links have been found that do not have traditional href attributes, which is an indication that this is a modern web application." + }, + { + "id": "101", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:280:10", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "121", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:328:13", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/node_modules\/express\/lib\/router\/index.js:328:13", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "102", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + } + ], + "count": "5", + "systemic": true, + "solution": "

This is an informational alert and so no changes are required.

", + "otherinfo": "

No links have been found while there are scripts, which is an indication that this is a modern web application.

", + "reference": "", + "cweid": "-1", + "wascid": "-1", + "sourceid": "9" + }, + { + "pluginid": "10112", + "alertRef": "10112", + "alert": "Session Management Response Identified", + "name": "Session Management Response Identified", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to \"Auto-Detect\" then this rule will change the session management to use the tokens identified.

", + "instances":[ + { + "id": "1", + "uri": "http://localhost:3000/rest/user/login", + "nodeName": "http:\/\/localhost:3000\/rest\/user\/login ()({email,password})", + "method": "POST", + "param": "authentication.token", + "attack": "", + "evidence": "authentication.token", + "otherinfo": "json:authentication.token" + } + ], + "count": "1", + "systemic": false, + "solution": "

This is an informational alert rather than a vulnerability and so there is nothing to fix.

", + "otherinfo": "

json:authentication.token

", + "reference": "

https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id/

", + "cweid": "-1", + "wascid": "-1", + "sourceid": "3" + } + ] + } + ], + "sequences":[ + ] + +} diff --git a/labs/lab5/zap/zap-report-noauth.json b/labs/lab5/zap/zap-report-noauth.json new file mode 100644 index 00000000..f23e37e6 --- /dev/null +++ b/labs/lab5/zap/zap-report-noauth.json @@ -0,0 +1,865 @@ +{ + "@programName": "ZAP", + "@version": "2.17.0", + "@generated": "Sun, 8 Mar 2026 13:25:10", + "created": "2026-03-08T13:25:10.337628739Z", + "insights":[ + { + "level": "Low", + "reason": "Warning", + "site": "", + "key": "insight.log.warn", + "description": "ZAP warnings logged - see the zap.log file for details", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.code.2xx", + "description": "Percentage of responses with status code 2xx", + "statistic": "91" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.code.4xx", + "description": "Percentage of responses with status code 4xx", + "statistic": "8" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.application/javascript", + "description": "Percentage of endpoints with content type application/javascript", + "statistic": "5" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.application/octet-stream", + "description": "Percentage of endpoints with content type application/octet-stream", + "statistic": "6" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.image/x-icon", + "description": "Percentage of endpoints with content type image/x-icon", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/css", + "description": "Percentage of endpoints with content type text/css", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/html", + "description": "Percentage of endpoints with content type text/html", + "statistic": "79" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/markdown", + "description": "Percentage of endpoints with content type text/markdown", + "statistic": "4" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.ctype.text/plain", + "description": "Percentage of endpoints with content type text/plain", + "statistic": "1" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.method.GET", + "description": "Percentage of endpoints with method GET", + "statistic": "100" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.endpoint.total", + "description": "Count of total endpoints", + "statistic": "72" + }, + { + "level": "Info", + "reason": "Informational", + "site": "http://localhost:3000", + "key": "insight.response.slow", + "description": "Percentage of slow responses", + "statistic": "45" + } + ], + "site":[ + { + "@name": "http://localhost:3000", + "@host": "localhost", + "@port": "3000", + "@ssl": "false", + "alerts": [ + { + "pluginid": "10038", + "alertRef": "10038-1", + "alert": "Content Security Policy (CSP) Header Not Set", + "name": "Content Security Policy (CSP) Header Not Set", + "riskcode": "2", + "confidence": "3", + "riskdesc": "Medium (High)", + "desc": "

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page \u2014 covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

", + "instances":[ + { + "id": "6", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "60", + "uri": "http://localhost:3000/ftp/eastere.gg", + "nodeName": "http:\/\/localhost:3000\/ftp\/eastere.gg", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "62", + "uri": "http://localhost:3000/ftp/encrypt.pyc", + "nodeName": "http:\/\/localhost:3000\/ftp\/encrypt.pyc", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "64", + "uri": "http://localhost:3000/ftp/package-lock.json.bak", + "nodeName": "http:\/\/localhost:3000\/ftp\/package-lock.json.bak", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "7", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.

", + "otherinfo": "", + "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP

https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

https://www.w3.org/TR/CSP/

https://w3c.github.io/webappsec-csp/

https://web.dev/articles/csp

https://caniuse.com/#feat=contentsecuritypolicy

https://content-security-policy.com/

", + "cweid": "693", + "wascid": "15", + "sourceid": "1" + }, + { + "pluginid": "10098", + "alertRef": "10098", + "alert": "Cross-Domain Misconfiguration", + "name": "Cross-Domain Misconfiguration", + "riskcode": "2", + "confidence": "2", + "riskdesc": "Medium (Medium)", + "desc": "

Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.

", + "instances":[ + { + "id": "0", + "uri": "http://localhost:3000/assets/public/favicon_js.ico", + "nodeName": "http:\/\/localhost:3000\/assets\/public\/favicon_js.ico", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "4", + "uri": "http://localhost:3000/polyfills.js", + "nodeName": "http:\/\/localhost:3000\/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "1", + "uri": "http://localhost:3000/robots.txt", + "nodeName": "http:\/\/localhost:3000\/robots.txt", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "2", + "uri": "http://localhost:3000/runtime.js", + "nodeName": "http:\/\/localhost:3000\/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + }, + { + "id": "5", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Access-Control-Allow-Origin: *", + "otherinfo": "The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing." + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance).

Configure the \"Access-Control-Allow-Origin\" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.

", + "otherinfo": "

The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.

", + "reference": "

https://vulncat.fortify.com/en/detail?category=HTML5&subcategory=Overly%20Permissive%20CORS%20Policy

", + "cweid": "264", + "wascid": "14", + "sourceid": "12" + }, + { + "pluginid": "10017", + "alertRef": "10017", + "alert": "Cross-Domain JavaScript Source File Inclusion", + "name": "Cross-Domain JavaScript Source File Inclusion", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The page includes one or more script files from a third-party domain.

", + "instances":[ + { + "id": "10", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "14", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "80", + "uri": "http://localhost:3000/", + "nodeName": "http:\/\/localhost:3000\/", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "11", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "13", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.

", + "otherinfo": "", + "reference": "", + "cweid": "829", + "wascid": "15", + "sourceid": "1" + }, + { + "pluginid": "90004", + "alertRef": "90004-2", + "alert": "Cross-Origin-Embedder-Policy Header Missing or Invalid", + "name": "Cross-Origin-Embedder-Policy Header Missing or Invalid", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).

", + "instances":[ + { + "id": "49", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "83", + "uri": "http://localhost:3000/ftp", + "nodeName": "http:\/\/localhost:3000\/ftp", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "93", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:43:13", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/build\/routes\/fileServer.js:43:13", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "95", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:59:18", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/build\/routes\/fileServer.js:59:18", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "54", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.

If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).

", + "otherinfo": "", + "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy

", + "cweid": "693", + "wascid": "14", + "sourceid": "1" + }, + { + "pluginid": "90004", + "alertRef": "90004-3", + "alert": "Cross-Origin-Opener-Policy Header Missing or Invalid", + "name": "Cross-Origin-Opener-Policy Header Missing or Invalid", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.

", + "instances":[ + { + "id": "52", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "84", + "uri": "http://localhost:3000/ftp", + "nodeName": "http:\/\/localhost:3000\/ftp", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "94", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:43:13", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/build\/routes\/fileServer.js:43:13", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "97", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:59:18", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/build\/routes\/fileServer.js:59:18", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "56", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure that the application/web server sets the Cross-Origin-Opener-Policy header appropriately, and that it sets the Cross-Origin-Opener-Policy header to 'same-origin' for documents.

'same-origin-allow-popups' is considered as less secured and should be avoided.

If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Opener-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-opener-policy).

", + "otherinfo": "", + "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy

", + "cweid": "693", + "wascid": "14", + "sourceid": "1" + }, + { + "pluginid": "10110", + "alertRef": "10110", + "alert": "Dangerous JS Functions", + "name": "Dangerous JS Functions", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "

A dangerous JS function seems to be in use that would leave the site vulnerable.

", + "instances":[ + { + "id": "58", + "uri": "http://localhost:3000/main.js", + "nodeName": "http:\/\/localhost:3000\/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "bypassSecurityTrustHtml(", + "otherinfo": "" + }, + { + "id": "105", + "uri": "http://localhost:3000/vendor.js", + "nodeName": "http:\/\/localhost:3000\/vendor.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "bypassSecurityTrustHtml(", + "otherinfo": "" + } + ], + "count": "2", + "systemic": false, + "solution": "

See the references for security advice on the use of these functions.

", + "otherinfo": "", + "reference": "

https://v17.angular.io/guide/security

", + "cweid": "749", + "wascid": "-1", + "sourceid": "22" + }, + { + "pluginid": "10063", + "alertRef": "10063-2", + "alert": "Deprecated Feature Policy Header Set", + "name": "Deprecated Feature Policy Header Set", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The header has now been renamed to Permissions-Policy.

", + "instances":[ + { + "id": "48", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "59", + "uri": "http://localhost:3000/main.js", + "nodeName": "http:\/\/localhost:3000\/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "43", + "uri": "http://localhost:3000/polyfills.js", + "nodeName": "http:\/\/localhost:3000\/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "41", + "uri": "http://localhost:3000/runtime.js", + "nodeName": "http:\/\/localhost:3000\/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "53", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "

Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.

", + "otherinfo": "", + "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy

https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/

", + "cweid": "16", + "wascid": "15", + "sourceid": "8" + }, + { + "pluginid": "10096", + "alertRef": "10096", + "alert": "Timestamp Disclosure - Unix", + "name": "Timestamp Disclosure - Unix", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "

A timestamp was disclosed by the application/web server. - Unix

", + "instances":[ + { + "id": "21", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1680327869", + "otherinfo": "1680327869, which evaluates to: 2023-04-01 05:44:29." + }, + { + "id": "18", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1701244813", + "otherinfo": "1701244813, which evaluates to: 2023-11-29 08:00:13." + }, + { + "id": "20", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1839622642", + "otherinfo": "1839622642, which evaluates to: 2028-04-17 22:17:22." + }, + { + "id": "22", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1863874346", + "otherinfo": "1863874346, which evaluates to: 2029-01-23 14:52:26." + }, + { + "id": "19", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2033195021", + "otherinfo": "2033195021, which evaluates to: 2034-06-06 08:23:41." + } + ], + "count": "5", + "systemic": true, + "solution": "

Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

", + "otherinfo": "

1680327869, which evaluates to: 2023-04-01 05:44:29.

", + "reference": "

https://cwe.mitre.org/data/definitions/200.html

", + "cweid": "497", + "wascid": "13", + "sourceid": "15" + }, + { + "pluginid": "10109", + "alertRef": "10109", + "alert": "Modern Web Application", + "name": "Modern Web Application", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.

", + "instances":[ + { + "id": "35", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "91", + "uri": "http://localhost:3000/", + "nodeName": "http:\/\/localhost:3000\/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "90", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:43:13", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/build\/routes\/fileServer.js:43:13", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "92", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:59:18", + "nodeName": "http:\/\/localhost:3000\/juice-shop\/build\/routes\/fileServer.js:59:18", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "36", + "uri": "http://localhost:3000/sitemap.xml", + "nodeName": "http:\/\/localhost:3000\/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + } + ], + "count": "5", + "systemic": true, + "solution": "

This is an informational alert and so no changes are required.

", + "otherinfo": "

No links have been found while there are scripts, which is an indication that this is a modern web application.

", + "reference": "", + "cweid": "-1", + "wascid": "-1", + "sourceid": "1" + }, + { + "pluginid": "10049", + "alertRef": "10049-1", + "alert": "Non-Storable Content", + "name": "Non-Storable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.

", + "instances":[ + { + "id": "67", + "uri": "http://localhost:3000/ftp/eastere.gg", + "nodeName": "http:\/\/localhost:3000\/ftp\/eastere.gg", + "method": "GET", + "param": "", + "attack": "", + "evidence": "403", + "otherinfo": "" + }, + { + "id": "71", + "uri": "http://localhost:3000/ftp/encrypt.pyc", + "nodeName": "http:\/\/localhost:3000\/ftp\/encrypt.pyc", + "method": "GET", + "param": "", + "attack": "", + "evidence": "403", + "otherinfo": "" + } + ], + "count": "2", + "systemic": true, + "solution": "

The content may be marked as storable by ensuring that the following conditions are satisfied:

The request method must be understood by the cache and defined as being cacheable (\"GET\", \"HEAD\", and \"POST\" are currently defined as cacheable)

The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)

The \"no-store\" cache directive must not appear in the request or response header fields

For caching by \"shared\" caches such as \"proxy\" caches, the \"private\" response directive must not appear in the response

For caching by \"shared\" caches such as \"proxy\" caches, the \"Authorization\" header field must not appear in the request, unless the response explicitly allows it (using one of the \"must-revalidate\", \"public\", or \"s-maxage\" Cache-Control response directives)

In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:

It must contain an \"Expires\" header field

It must contain a \"max-age\" response directive

For \"shared\" caches such as \"proxy\" caches, it must contain a \"s-maxage\" response directive

It must contain a \"Cache Control Extension\" that allows it to be cached

It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).

", + "otherinfo": "", + "reference": "

https://datatracker.ietf.org/doc/html/rfc7234

https://datatracker.ietf.org/doc/html/rfc7231

https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html

", + "cweid": "524", + "wascid": "13", + "sourceid": "40" + }, + { + "pluginid": "10049", + "alertRef": "10049-3", + "alert": "Storable and Cacheable Content", + "name": "Storable and Cacheable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where \"shared\" caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.

", + "instances":[ + { + "id": "39", + "uri": "http://localhost:3000/robots.txt", + "nodeName": "http:\/\/localhost:3000\/robots.txt", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234." + } + ], + "count": "1", + "systemic": true, + "solution": "

Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:

Cache-Control: no-cache, no-store, must-revalidate, private

Pragma: no-cache

Expires: 0

This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.

", + "otherinfo": "

In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.

", + "reference": "

https://datatracker.ietf.org/doc/html/rfc7234

https://datatracker.ietf.org/doc/html/rfc7231

https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html

", + "cweid": "524", + "wascid": "13", + "sourceid": "6" + }, + { + "pluginid": "10049", + "alertRef": "10049-2", + "alert": "Storable but Non-Cacheable Content", + "name": "Storable but Non-Cacheable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.

", + "instances":[ + { + "id": "45", + "uri": "http://localhost:3000", + "nodeName": "http:\/\/localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "3", + "uri": "http://localhost:3000/assets/public/favicon_js.ico", + "nodeName": "http:\/\/localhost:3000\/assets\/public\/favicon_js.ico", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "42", + "uri": "http://localhost:3000/polyfills.js", + "nodeName": "http:\/\/localhost:3000\/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "40", + "uri": "http://localhost:3000/runtime.js", + "nodeName": "http:\/\/localhost:3000\/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "44", + "uri": "http://localhost:3000/styles.css", + "nodeName": "http:\/\/localhost:3000\/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + } + ], + "count": "5", + "systemic": true, + "solution": "", + "otherinfo": "", + "reference": "

https://datatracker.ietf.org/doc/html/rfc7234

https://datatracker.ietf.org/doc/html/rfc7231

https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html

", + "cweid": "524", + "wascid": "13", + "sourceid": "1" + } + ] + } + ], + "sequences":[ + ] + +} diff --git a/labs/lab5/zap/zap.yaml b/labs/lab5/zap/zap.yaml new file mode 100644 index 00000000..d1e52088 --- /dev/null +++ b/labs/lab5/zap/zap.yaml @@ -0,0 +1,40 @@ +env: + contexts: + - excludePaths: [] + name: baseline + urls: + - http://localhost:3000 + parameters: + failOnError: true + progressToStdout: false +jobs: +- parameters: + enableTags: false + maxAlertsPerRule: 10 + type: passiveScan-config +- parameters: + maxDuration: 1 + url: http://localhost:3000 + type: spider +- parameters: + maxDuration: 0 + type: passiveScan-wait +- parameters: + format: Long + summaryFile: /home/zap/zap_out.json + rules: [] + type: outputSummary +- parameters: + reportDescription: '' + reportDir: /zap/wrk/ + reportFile: report-noauth.html + reportTitle: ZAP Scanning Report + template: traditional-html + type: report +- parameters: + reportDescription: '' + reportDir: /zap/wrk/ + reportFile: zap-report-noauth.json + reportTitle: ZAP Scanning Report + template: traditional-json + type: report diff --git a/labs/submission5.md b/labs/submission5.md new file mode 100644 index 00000000..7c6aa83e --- /dev/null +++ b/labs/submission5.md @@ -0,0 +1,140 @@ +# Lab 5 — Security Analysis: SAST & DAST of OWASP Juice Shop + +**Target:** `bkimminich/juice-shop:v19.0.0` +**Date:** March 8, 2026 + +## Task 1 — SAST with Semgrep + +### SAST Tool Effectiveness +- Tool: `semgrep/semgrep:latest` with `p/security-audit` + `p/owasp-top-ten`. +- Findings: **25** total (`ERROR: 7`, `WARNING: 18`). +- Files scanned: **847** (`labs/lab5/semgrep/semgrep-results.json`). +- Coverage quality: broad TypeScript/JavaScript coverage, with direct detection of: + - SQL injection patterns in Sequelize queries + - Dangerous dynamic code execution (`eval`) + - Hardcoded secrets + - Path traversal/file disclosure patterns + - Open redirect patterns + +### Critical Vulnerability Analysis (Top 5) + +Severity mapping used: `ERROR -> High`, `WARNING -> Medium`. + +| # | Vulnerability Type | File:Line | Semgrep Severity | +|---|---|---|---| +| 1 | Code Injection / RCE risk (`eval` with request data) | `/src/routes/userProfile.ts:62` | ERROR (High) | +| 2 | SQL Injection (tainted input into Sequelize) | `/src/routes/login.ts:34` | ERROR (High) | +| 3 | SQL Injection (tainted input into Sequelize) | `/src/routes/search.ts:23` | ERROR (High) | +| 4 | Hardcoded JWT Secret / Credential Exposure | `/src/lib/insecurity.ts:56` | WARNING (Medium) | +| 5 | Path Traversal / Arbitrary File Read via `sendFile` | `/src/routes/fileServer.ts:33` | WARNING (Medium) | + +## Task 2 — DAST with Multiple Tools + +### Authenticated vs Unauthenticated Scanning (ZAP) + +Source: `labs/lab5/analysis/zap-comparison.txt` + +- Unauthenticated scan: + - Total alerts: **12** + - Unique URLs with findings: **16** +- Authenticated scan: + - Total alerts: **8** + - Unique URLs with findings: **10** + +Authenticated endpoints discovered in authenticated run: +- `http://localhost:3000/rest/user` +- `http://localhost:3000/rest/user/login` + +Why authenticated scanning matters: +- It tests session-aware behavior and routes not visible in purely public browsing. +- It validates auth/session flows (login and stateful behavior), which unauth scans cannot verify deeply. +- It is required to reveal user-context attack paths (authorization, session handling, identity endpoints). + +Note on execution profile: to keep host resource usage stable, authenticated ZAP used a bounded profile (`spider + passive + short active`) without long AJAX crawling. + +### Tool Comparison Matrix + +| Tool | Findings | Severity Breakdown | Best Use Case | +|---|---:|---|---| +| ZAP (authenticated) | 8 alert types | Medium: 2, Low: 3, Info: 3 | Broad web-app runtime assessment, auth/session testing | +| Nuclei | 1 | Medium: 1 | Fast template-based checks and repeatable policy checks | +| Nikto | 82 | Mixed server/misconfiguration style findings (no native severity tiers) | Web server hardening and exposed path/header checks | +| SQLmap | 2 injection points | SQLi confirmed on 2 parameters (high impact) | Deep SQL injection verification and DBMS fingerprinting | + +### Tool-Specific Strengths with Examples + +- **ZAP** + - Strengths: end-to-end web scanning, authentication workflow support, structured HTML/JSON reports. + - Example findings: + - `Content Security Policy (CSP) Header Not Set` + - `Cross-Domain Misconfiguration` + +- **Nuclei** + - Strengths: lightweight, template-driven checks for fast recurring scans. + - Example finding: + - `Missing Security Headers` (medium) + +- **Nikto** + - Strengths: server misconfiguration and exposed resource probing. + - Example findings: + - Missing `X-XSS-Protection` header + - `/ftp/` exposed via `robots.txt` and additional interesting paths + +- **SQLmap** + - Strengths: confirms exploitability of SQL injection and identifies DBMS. + - Example findings: + - `/rest/products/search?q=*` injectable (boolean-based blind) + - `/rest/user/login` JSON `email` parameter injectable (boolean-based blind) + - Back-end DBMS fingerprint: `SQLite` + +## Task 3 — SAST/DAST Correlation and Security Assessment + +### SAST vs DAST Comparison + +- SAST findings: **25** +- Combined DAST findings: **93** (`ZAP 8 + Nuclei 1 + Nikto 82 + SQLmap 2`) + +Vulnerability types found **only by SAST**: +- Hardcoded credential/secret in source (`jwt-hardcode`) +- Dangerous code execution sink (`eval` data flow) +- Unquoted template-variable sink patterns in frontend templates + +Vulnerability types found **only by DAST**: +- Runtime HTTP header misconfiguration (CSP/XSS/security header gaps) +- Runtime cache/cross-origin behavior findings +- Live SQL injection exploit confirmation against running endpoints + +Why they differ: +- SAST inspects source logic and taint flows without executing the app. +- DAST validates actual runtime behavior, responses, deployment headers, and exploitability. +- Together they reduce blind spots: SAST finds latent code defects early; DAST proves what is reachable/exploitable at runtime. + +### Security Recommendations + +1. Replace raw/dynamic SQL patterns with strict parameterized query usage in login/search code paths. +2. Remove hardcoded secrets from source and load secrets through environment variables or a secret manager. +3. Eliminate request-influenced `eval` usage in `/src/routes/userProfile.ts`. +4. Harden file-serving routes (`sendFile`) with strict path allowlisting and canonical path validation. +5. Add/strengthen security headers (`Content-Security-Policy`, transport and cross-origin hardening headers). +6. Integrate Semgrep + ZAP + Nuclei + Nikto + SQLmap checks into CI/CD with guardrail thresholds for regression prevention. + +## Evidence Files + +- SAST: + - `labs/lab5/semgrep/semgrep-results.json` + - `labs/lab5/semgrep/semgrep-report.txt` + - `labs/lab5/analysis/sast-analysis.txt` +- DAST: + - `labs/lab5/zap/zap-report-noauth.json` + - `labs/lab5/zap/zap-report-auth.json` + - `labs/lab5/zap/report-noauth.html` + - `labs/lab5/zap/report-auth.html` + - `labs/lab5/nuclei/nuclei-results.json` + - `labs/lab5/nikto/nikto-results.txt` + - `labs/lab5/sqlmap/localhost/log` + - `labs/lab5/sqlmap/results-03082026_0159pm.csv` + - `labs/lab5/sqlmap/results-03082026_0200pm.csv` +- Analysis: + - `labs/lab5/analysis/zap-comparison.txt` + - `labs/lab5/analysis/dast-summary.txt` + - `labs/lab5/analysis/correlation.txt` From 1b0d52e2125f13bdeb4138d88933a11e673db99d Mon Sep 17 00:00:00 2001 From: Rashid Badamshin Date: Tue, 17 Mar 2026 11:21:36 +0300 Subject: [PATCH 14/15] lab6 done --- labs/lab6/analysis/ansible-analysis.txt | 6 + .../analysis/checkov-terraform-report.txt | 516 + .../analysis/checkov-terraform-results.json | 17139 ++++++++++++++++ labs/lab6/analysis/kics-ansible-report.html | 52 + labs/lab6/analysis/kics-ansible-report.txt | 53 + labs/lab6/analysis/kics-ansible-results.json | 206 + labs/lab6/analysis/kics-pulumi-report.html | 50 + labs/lab6/analysis/kics-pulumi-report.txt | 51 + labs/lab6/analysis/kics-pulumi-results.json | 202 + labs/lab6/analysis/pulumi-analysis.txt | 6 + labs/lab6/analysis/terraform-comparison.txt | 4 + labs/lab6/analysis/terrascan-report.txt | 216 + labs/lab6/analysis/terrascan-results.json | 303 + labs/lab6/analysis/tfsec-report.txt | 1102 + labs/lab6/analysis/tfsec-results.json | 1225 ++ labs/lab6/analysis/tool-comparison.txt | 8 + labs/submission6.md | 268 + 17 files changed, 21407 insertions(+) create mode 100644 labs/lab6/analysis/ansible-analysis.txt create mode 100644 labs/lab6/analysis/checkov-terraform-report.txt create mode 100644 labs/lab6/analysis/checkov-terraform-results.json create mode 100755 labs/lab6/analysis/kics-ansible-report.html create mode 100644 labs/lab6/analysis/kics-ansible-report.txt create mode 100755 labs/lab6/analysis/kics-ansible-results.json create mode 100755 labs/lab6/analysis/kics-pulumi-report.html create mode 100644 labs/lab6/analysis/kics-pulumi-report.txt create mode 100755 labs/lab6/analysis/kics-pulumi-results.json create mode 100644 labs/lab6/analysis/pulumi-analysis.txt create mode 100644 labs/lab6/analysis/terraform-comparison.txt create mode 100644 labs/lab6/analysis/terrascan-report.txt create mode 100644 labs/lab6/analysis/terrascan-results.json create mode 100644 labs/lab6/analysis/tfsec-report.txt create mode 100644 labs/lab6/analysis/tfsec-results.json create mode 100644 labs/lab6/analysis/tool-comparison.txt create mode 100644 labs/submission6.md diff --git a/labs/lab6/analysis/ansible-analysis.txt b/labs/lab6/analysis/ansible-analysis.txt new file mode 100644 index 00000000..694306dd --- /dev/null +++ b/labs/lab6/analysis/ansible-analysis.txt @@ -0,0 +1,6 @@ +=== Ansible Security Analysis (KICS) === +KICS Ansible findings: 10 + CRITICAL severity: 0 + HIGH severity: 9 + MEDIUM severity: 0 + LOW severity: 1 diff --git a/labs/lab6/analysis/checkov-terraform-report.txt b/labs/lab6/analysis/checkov-terraform-report.txt new file mode 100644 index 00000000..04cd190c --- /dev/null +++ b/labs/lab6/analysis/checkov-terraform-report.txt @@ -0,0 +1,516 @@ + + _ _ + ___| |__ ___ ___| | _______ __ + / __| '_ \ / _ \/ __| |/ / _ \ \ / / + | (__| | | | __/ (__| < (_) \ V / + \___|_| |_|\___|\___|_|\_\___/ \_/ + +By Prisma Cloud | version: 3.2.508 + +terraform scan results: + +Passed checks: 48, Failed checks: 78, Skipped checks: 0 + +Check: CKV_AWS_211: "Ensure RDS uses a modern CaCert" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert +Check: CKV_AWS_250: "Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-postgresql-instances-use-a-non-vulnerable-version-of-log-fdw-extension +Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354 +Check: CKV_AWS_388: "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 +Check: CKV_AWS_211: "Ensure RDS uses a modern CaCert" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert +Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2 +Check: CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354 +Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4 +Check: CKV_AWS_133: "Ensure that RDS instances has backup policy" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy +Check: CKV_AWS_388: "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 +Check: CKV_AWS_274: "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy" + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-274 +Check: CKV_AWS_61: "Ensure AWS IAM policy does not allow assume role permission across all services" + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_60: "Ensure IAM role allows only specific services or principals to assume it" + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-44 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_348: "Ensure IAM root user does not have Access keys" + PASSED for resource: aws_iam_access_key.service_key + File: /iam.tf:88-90 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-348 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_93: "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)" + PASSED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24 +Check: CKV_AWS_93: "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)" + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24 +Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80" + PASSED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80 +Check: CKV_AWS_277: "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1" + PASSED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports +Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security +Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80 +Check: CKV_AWS_277: "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports +Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2 +Check: CKV2_AWS_56: "Ensure AWS Managed IAMFullAccess IAM policy is not used." + PASSED for resource: aws_iam_role.app_role + File: /iam.tf:22-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-56 +Check: CKV2_AWS_69: "Ensure AWS RDS database instance configured with encryption in transit" + PASSED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69 +Check: CKV2_AWS_69: "Ensure AWS RDS database instance configured with encryption in transit" + PASSED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69 +Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource" + PASSED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis +Check: CKV_AWS_57: "S3 Bucket has an ACL defined which allows public WRITE access." + PASSED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone +Check: CKV_AWS_57: "S3 Bucket has an ACL defined which allows public WRITE access." + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone +Check: CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest" + PASSED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest +Check: CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest" + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest +Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public READ access." + PASSED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone +Check: CKV2_AWS_22: "Ensure an IAM User does not have access to the console" + PASSED for resource: aws_iam_user.service_account + File: /iam.tf:58-65 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-an-iam-user-does-not-have-access-to-the-console-group +Check: CKV2_AWS_16: "Ensure that Auto Scaling is enabled on your DynamoDB tables" + PASSED for resource: aws_dynamodb_table.unencrypted_table + File: /database.tf:72-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-auto-scaling-is-enabled-on-your-dynamodb-tables +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + PASSED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + PASSED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + PASSED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 +Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances +Check: CKV_AWS_161: "Ensure RDS database has IAM authentication enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled +Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293 +Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2 +Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4 +Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled +Check: CKV_AWS_353: "Ensure that RDS instances have performance insights enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353 +Check: CKV_AWS_133: "Ensure that RDS instances has backup policy" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy +Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73 +Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically +Check: CKV_AWS_118: "Ensure that enhanced monitoring is enabled for Amazon RDS instances" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances +Check: CKV_AWS_161: "Ensure RDS database has IAM authentication enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled +Check: CKV_AWS_293: "Ensure that AWS database instances have deletion protection enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293 +Check: CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled +Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73 +Check: CKV_AWS_226: "Ensure DB instance gets all minor upgrades automatically" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically +Check: CKV_AWS_28: "Ensure DynamoDB point in time recovery (backup) is enabled" + FAILED for resource: aws_dynamodb_table.unencrypted_table + File: /database.tf:72-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-6 +Check: CKV_AWS_119: "Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK" + FAILED for resource: aws_dynamodb_table.unencrypted_table + File: /database.tf:72-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-52 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_63: "Ensure no IAM policies documents allow "*" as a statement's actions" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_62: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + FAILED for resource: aws_iam_role_policy.s3_full_access + File: /iam.tf:39-55 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_273: "Ensure access is controlled through SSO and not AWS IAM defined users" + FAILED for resource: aws_iam_user.service_account + File: /iam.tf:58-65 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273 +Check: CKV_AWS_40: "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-16-iam-policy-privileges-1 +Check: CKV_AWS_290: "Ensure IAM policies does not allow write access without constraints" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290 +Check: CKV_AWS_287: "Ensure IAM policies does not allow credentials exposure" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_288: "Ensure IAM policies does not allow data exfiltration" + FAILED for resource: aws_iam_user_policy.service_policy + File: /iam.tf:67-85 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288 +Check: CKV_AWS_286: "Ensure IAM policies does not allow privilege escalation" + FAILED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286 +Check: CKV_AWS_289: "Ensure IAM policies does not allow permissions management / resource exposure without constraints" + FAILED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289 +Check: CKV_AWS_355: "Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions" + FAILED for resource: aws_iam_policy.privilege_escalation + File: /iam.tf:104-125 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355 +Check: CKV_AWS_55: "Ensure S3 bucket has ignore public ACLs enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-21 +Check: CKV_AWS_56: "Ensure S3 bucket has 'restrict_public_buckets' enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-22 +Check: CKV_AWS_54: "Ensure S3 bucket has block public policy enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-20 +Check: CKV_AWS_53: "Ensure S3 bucket has block public ACLS enabled" + FAILED for resource: aws_s3_bucket_public_access_block.bad_config + File: /main.tf:36-43 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-19 +Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider" + FAILED for resource: aws.default + File: /main.tf:5-10 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5 +Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security +Check: CKV_AWS_23: "Ensure every security group and rule has a description" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31 +Check: CKV_AWS_260: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80 +Check: CKV_AWS_277: "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports +Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382 +Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2 +Check: CKV_AWS_24: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security +Check: CKV_AWS_23: "Ensure every security group and rule has a description" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31 +Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382 +Check: CKV_AWS_25: "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2 +Check: CKV_AWS_23: "Ensure every security group and rule has a description" + FAILED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31 +Check: CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1" + FAILED for resource: aws_security_group.database_exposed + File: /security_groups.tf:65-92 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382 +Check: CKV2_AWS_30: "Ensure Postgres RDS as aws_db_instance has Query Logging enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-postgres-rds-has-query-logging-enabled +Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61 +Check: CKV2_AWS_61: "Ensure that an S3 bucket has a lifecycle configuration" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61 +Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning +Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning +Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled +Check: CKV_AWS_144: "Ensure that S3 bucket has cross-region replication enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled +Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging +Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging +Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource" + FAILED for resource: aws_security_group.allow_all + File: /security_groups.tf:5-28 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis +Check: CKV2_AWS_5: "Ensure that Security Groups are attached to another resource" + FAILED for resource: aws_security_group.ssh_open + File: /security_groups.tf:31-62 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis +Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62 +Check: CKV2_AWS_62: "Ensure S3 buckets should have event notifications enabled" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62 +Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public READ access." + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone +Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled" + FAILED for resource: aws_db_instance.unencrypted_db + File: /database.tf:5-37 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60 +Check: CKV2_AWS_60: "Ensure RDS instance with copy tags to snapshots is enabled" + FAILED for resource: aws_db_instance.weak_db + File: /database.tf:40-69 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60 +Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached +Check: CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached +Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default" + FAILED for resource: aws_s3_bucket.public_data + File: /main.tf:13-21 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default +Check: CKV_AWS_145: "Ensure that S3 buckets are encrypted with KMS by default" + FAILED for resource: aws_s3_bucket.unencrypted_data + File: /main.tf:24-33 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default +Check: CKV2_AWS_40: "Ensure AWS IAM policy does not allow full IAM privileges" + FAILED for resource: aws_iam_policy.admin_policy + File: /iam.tf:5-19 + Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40 + diff --git a/labs/lab6/analysis/checkov-terraform-results.json b/labs/lab6/analysis/checkov-terraform-results.json new file mode 100644 index 00000000..66da193e --- /dev/null +++ b/labs/lab6/analysis/checkov-terraform-results.json @@ -0,0 +1,17139 @@ +{ + "check_type": "terraform", + "results": { + "passed_checks": [ + { + "check_id": "CKV_AWS_211", + "bc_check_id": "BC_AWS_GENERAL_118", + "check_name": "Ensure RDS uses a modern CaCert", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "ca_cert_identifier" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSCACertIsRecent", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_250", + "bc_check_id": "BC_AWS_GENERAL_130", + "check_name": "Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "engine", + "engine_version" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSPostgreSQLLogFDWExtension", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-postgresql-instances-use-a-non-vulnerable-version-of-log-fdw-extension", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_354", + "bc_check_id": "BC_AWS_GENERAL_254", + "check_name": "Ensure RDS Performance Insights are encrypted using KMS CMKs", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "performance_insights_kms_key_id" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstancePerfInsightsEncryptionWithCMK", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_388", + "bc_check_id": null, + "check_name": "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.UnpatchedAuroraPostgresDB", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": {}, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_211", + "bc_check_id": "BC_AWS_GENERAL_118", + "check_name": "Ensure RDS uses a modern CaCert", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "ca_cert_identifier" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSCACertIsRecent", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-rds-uses-a-modern-cacert", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_17", + "bc_check_id": "BC_AWS_PUBLIC_2", + "check_name": "Ensure all data stored in RDS is not publicly accessible", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "publicly_accessible" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSPubliclyAccessible", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_354", + "bc_check_id": "BC_AWS_GENERAL_254", + "check_name": "Ensure RDS Performance Insights are encrypted using KMS CMKs", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "performance_insights_kms_key_id" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstancePerfInsightsEncryptionWithCMK", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-354", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_16", + "bc_check_id": "BC_AWS_GENERAL_4", + "check_name": "Ensure all data stored in the RDS is securely encrypted at rest", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "storage_encrypted" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEncryption", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_133", + "bc_check_id": "BC_AWS_GENERAL_46", + "check_name": "Ensure that RDS instances has backup policy", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "backup_retention_period" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceBackupRetentionPeriod", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_388", + "bc_check_id": null, + "check_name": "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.UnpatchedAuroraPostgresDB", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": {}, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": null, + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_274", + "bc_check_id": "BC_AWS_IAM_78", + "check_name": "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMManagedAdminPolicy", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-274", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_61", + "bc_check_id": "BC_AWS_IAM_45", + "check_name": "Ensure AWS IAM policy does not allow assume role permission across all services", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "assume_role_policy" + ] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMRoleAllowAssumeFromAccount", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_60", + "bc_check_id": "BC_AWS_IAM_44", + "check_name": "Ensure IAM role allows only specific services or principals to assume it", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "assume_role_policy" + ] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMRoleAllowsPublicAssume", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-44", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_348", + "bc_check_id": "BC_AWS_IAM_87", + "check_name": "Ensure IAM root user does not have Access keys", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "user" + ] + }, + "code_block": [ + [ + 88, + "resource \"aws_iam_access_key\" \"service_key\" {\n" + ], + [ + 89, + " user = aws_iam_user.service_account.name\n" + ], + [ + 90, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 88, + 90 + ], + "resource": "aws_iam_access_key.service_key", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMUserRootAccessKeys", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-348", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_93", + "bc_check_id": "BC_AWS_S3_24", + "check_name": "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3ProtectAgainstPolicyLockout", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_93", + "bc_check_id": "BC_AWS_S3_24", + "check_name": "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)", + "check_result": { + "result": "PASSED", + "evaluated_keys": [ + "policy" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3ProtectAgainstPolicyLockout", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_260", + "bc_check_id": "BC_AWS_NETWORKING_67", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress80", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_277", + "bc_check_id": "BC_AWS_NETWORKING_78", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_24", + "bc_check_id": "BC_AWS_NETWORKING_1", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress22", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_260", + "bc_check_id": "BC_AWS_NETWORKING_67", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress80", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_277", + "bc_check_id": "BC_AWS_NETWORKING_78", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngressAny", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_25", + "bc_check_id": "BC_AWS_NETWORKING_2", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389", + "check_result": { + "result": "PASSED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress3389", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV2_AWS_56", + "bc_check_id": "BC_AWS_IAM_75", + "check_name": "Ensure AWS Managed IAMFullAccess IAM policy is not used.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_role": { + "app_role": { + "__end_line__": 37, + "__start_line__": 22, + "assume_role_policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Action": "sts:AssumeRole", + "Effect": "Allow", + "Principal": { + "Service": "ec2.amazonaws.com" + } + } + ] + } + ], + "name": [ + "application-role" + ], + "__address__": "aws_iam_role.app_role" + } + } + }, + "evaluated_keys": [ + "managed_policy_arns/*", + "arn", + "managed_policy_arn", + "policy_arn", + "name" + ] + }, + "code_block": [ + [ + 22, + "resource \"aws_iam_role\" \"app_role\" {\n" + ], + [ + 23, + " name = \"application-role\"\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " assume_role_policy = jsonencode({\n" + ], + [ + 26, + " Version = \"2012-10-17\"\n" + ], + [ + 27, + " Statement = [\n" + ], + [ + 28, + " {\n" + ], + [ + 29, + " Action = \"sts:AssumeRole\"\n" + ], + [ + 30, + " Effect = \"Allow\"\n" + ], + [ + 31, + " Principal = {\n" + ], + [ + 32, + " Service = \"ec2.amazonaws.com\"\n" + ], + [ + 33, + " }\n" + ], + [ + 34, + " }\n" + ], + [ + 35, + " ]\n" + ], + [ + 36, + " })\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 22, + 37 + ], + "resource": "aws_iam_role.app_role", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-56", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_57", + "bc_check_id": "BC_AWS_S3_2", + "check_name": "S3 Bucket has an ACL defined which allows public WRITE access.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "access_control_policy/grant/*/grantee/uri", + "access_control_policy/grant", + "resource_type", + "access_control_policy", + "access_control_policy/grant/*/permission", + "acl" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_57", + "bc_check_id": "BC_AWS_S3_2", + "check_name": "S3 Bucket has an ACL defined which allows public WRITE access.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "access_control_policy/grant/*/grantee/uri", + "access_control_policy/grant", + "resource_type", + "access_control_policy", + "access_control_policy/grant/*/permission", + "acl" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_69", + "bc_check_id": "BC_AWS_NETWORKING_93", + "check_name": "Ensure AWS RDS database instance configured with encryption in transit", + "check_result": { + "result": "PASSED", + "entity": { + "aws_db_instance": { + "unencrypted_db": { + "__end_line__": 37, + "__start_line__": 5, + "allocated_storage": [ + 20 + ], + "backup_retention_period": [ + 0 + ], + "deletion_protection": [ + false + ], + "enabled_cloudwatch_logs_exports": [ + [] + ], + "engine": [ + "postgres" + ], + "engine_version": [ + "13.7" + ], + "identifier": [ + "mydb-unencrypted" + ], + "instance_class": [ + "db.t3.micro" + ], + "password": [ + "SuperSecretPassword123!" + ], + "publicly_accessible": [ + true + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + false + ], + "tags": [ + { + "Name": "Unencrypted Database" + } + ], + "username": [ + "admin" + ], + "vpc_security_group_ids": [ + [ + "aws_security_group.database_exposed.id" + ] + ], + "__address__": "aws_db_instance.unencrypted_db" + } + } + }, + "evaluated_keys": [ + "parameter[?(@/name=='rds/force_ssl')]/value", + "resource_type", + "parameter[?(@/name=='require_secure_transport')]/value", + "family", + "parameter[?(@/name=='db2comm')]/value" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_69", + "bc_check_id": "BC_AWS_NETWORKING_93", + "check_name": "Ensure AWS RDS database instance configured with encryption in transit", + "check_result": { + "result": "PASSED", + "entity": { + "aws_db_instance": { + "weak_db": { + "__end_line__": 69, + "__start_line__": 40, + "allocated_storage": [ + 20 + ], + "auto_minor_version_upgrade": [ + false + ], + "engine": [ + "mysql" + ], + "engine_version": [ + "5.7.38" + ], + "identifier": [ + "mydb-weak" + ], + "instance_class": [ + "db.t3.micro" + ], + "kms_key_id": [ + "" + ], + "multi_az": [ + false + ], + "password": [ + "password123" + ], + "performance_insights_enabled": [ + false + ], + "publicly_accessible": [ + false + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + true + ], + "tags": [ + { + "Name": "Weak Database" + } + ], + "username": [ + "root" + ], + "__address__": "aws_db_instance.weak_db" + } + } + }, + "evaluated_keys": [ + "parameter[?(@/name=='rds/force_ssl')]/value", + "resource_type", + "parameter[?(@/name=='require_secure_transport')]/value", + "family", + "parameter[?(@/name=='db2comm')]/value" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-2-69", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_5", + "bc_check_id": "BC_AWS_NETWORKING_51", + "check_name": "Ensure that Security Groups are attached to another resource", + "check_result": { + "result": "PASSED", + "entity": { + "aws_security_group": { + "database_exposed": { + "__end_line__": 92, + "__start_line__": 65, + "description": [ + "Database accessible from internet" + ], + "egress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 0 + ] + } + ], + "ingress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "MySQL from anywhere" + ], + "from_port": [ + 3306 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 3306 + ] + }, + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "PostgreSQL from anywhere" + ], + "from_port": [ + 5432 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 5432 + ] + } + ], + "name": [ + "database-public" + ], + "vpc_id": [ + "vpc-12345678" + ], + "__address__": "aws_security_group.database_exposed" + } + } + }, + "evaluated_keys": [ + "resource_type", + "networking" + ] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": { + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "entity_tags": { + "Name": "Unencrypted Database" + }, + "evaluations": null, + "file_abs_path": "/tf/database.tf", + "resource_address": null + }, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_19", + "bc_check_id": "BC_AWS_S3_14", + "check_name": "Ensure all data stored in the S3 bucket is securely encrypted at rest", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_19", + "bc_check_id": "BC_AWS_S3_14", + "check_name": "Ensure all data stored in the S3 bucket is securely encrypted at rest", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_22", + "bc_check_id": "BC_AWS_IAM_67", + "check_name": "Ensure an IAM User does not have access to the console", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_user": { + "service_account": { + "__end_line__": 65, + "__start_line__": 58, + "name": [ + "service-account" + ], + "path": [ + "/system/" + ], + "tags": [ + { + "Name": "Service Account" + } + ], + "__address__": "aws_iam_user.service_account" + } + } + }, + "evaluated_keys": [ + "resource_type" + ] + }, + "code_block": [ + [ + 58, + "resource \"aws_iam_user\" \"service_account\" {\n" + ], + [ + 59, + " name = \"service-account\"\n" + ], + [ + 60, + " path = \"/system/\"\n" + ], + [ + 61, + "\n" + ], + [ + 62, + " tags = {\n" + ], + [ + 63, + " Name = \"Service Account\"\n" + ], + [ + 64, + " }\n" + ], + [ + 65, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 58, + 65 + ], + "resource": "aws_iam_user.service_account", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Service Account" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-an-iam-user-does-not-have-access-to-the-console-group", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_20", + "bc_check_id": "BC_AWS_S3_1", + "check_name": "S3 Bucket has an ACL defined which allows public READ access.", + "check_result": { + "result": "PASSED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "access_control_policy/grant/*/grantee/uri", + "access_control_policy/grant", + "resource_type", + "access_control_policy", + "acl" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_16", + "bc_check_id": "BC_AWS_GENERAL_44", + "check_name": "Ensure that Auto Scaling is enabled on your DynamoDB tables", + "check_result": { + "result": "PASSED", + "entity": { + "aws_dynamodb_table": { + "unencrypted_table": { + "__end_line__": 92, + "__start_line__": 72, + "attribute": [ + { + "name": [ + "id" + ], + "type": [ + "S" + ] + } + ], + "billing_mode": [ + "PAY_PER_REQUEST" + ], + "hash_key": [ + "id" + ], + "name": [ + "my-table" + ], + "point_in_time_recovery": [ + { + "enabled": [ + false + ] + } + ], + "tags": [ + { + "Name": "Unencrypted DynamoDB Table" + } + ], + "__address__": "aws_dynamodb_table.unencrypted_table" + } + } + }, + "evaluated_keys": [ + "resource_type", + "service_namespace", + "billing_mode" + ] + }, + "code_block": [ + [ + 72, + "resource \"aws_dynamodb_table\" \"unencrypted_table\" {\n" + ], + [ + 73, + " name = \"my-table\"\n" + ], + [ + 74, + " billing_mode = \"PAY_PER_REQUEST\"\n" + ], + [ + 75, + " hash_key = \"id\"\n" + ], + [ + 76, + "\n" + ], + [ + 77, + " attribute {\n" + ], + [ + 78, + " name = \"id\"\n" + ], + [ + 79, + " type = \"S\"\n" + ], + [ + 80, + " }\n" + ], + [ + 81, + "\n" + ], + [ + 82, + " # No server_side_encryption configuration!\n" + ], + [ + 83, + " \n" + ], + [ + 84, + " # No point-in-time recovery\n" + ], + [ + 85, + " point_in_time_recovery {\n" + ], + [ + 86, + " enabled = false # SECURITY ISSUE #17\n" + ], + [ + 87, + " }\n" + ], + [ + 88, + "\n" + ], + [ + 89, + " tags = {\n" + ], + [ + 90, + " Name = \"Unencrypted DynamoDB Table\"\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 72, + 92 + ], + "resource": "aws_dynamodb_table.unencrypted_table", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted DynamoDB Table" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-auto-scaling-is-enabled-on-your-dynamodb-tables", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_role_policy": { + "s3_full_access": { + "__end_line__": 55, + "__start_line__": 39, + "name": [ + "s3-full-access" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "s3:*" + ], + "Resource": "*" + } + ] + } + ], + "role": [ + "aws_iam_role.app_role.id" + ], + "__address__": "aws_iam_role_policy.s3_full_access" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_user_policy": { + "service_policy": { + "__end_line__": 85, + "__start_line__": 67, + "name": [ + "service-inline-policy" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:*", + "s3:*", + "rds:*" + ], + "Resource": "*" + } + ] + } + ], + "user": [ + "service-account" + ], + "__address__": "aws_iam_user_policy.service_policy" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "PASSED", + "entity": { + "aws_iam_policy": { + "privilege_escalation": { + "__end_line__": 125, + "__start_line__": 104, + "description": [ + "Policy that allows privilege escalation" + ], + "name": [ + "potential-privilege-escalation" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "iam:CreatePolicy", + "iam:CreateUser", + "iam:AttachUserPolicy", + "iam:AttachRolePolicy", + "iam:PutUserPolicy", + "iam:PutRolePolicy" + ], + "Resource": "*" + } + ] + } + ], + "__address__": "aws_iam_policy.privilege_escalation" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + } + ], + "failed_checks": [ + { + "check_id": "CKV_AWS_118", + "bc_check_id": "BC_AWS_LOGGING_28", + "check_name": "Ensure that enhanced monitoring is enabled for Amazon RDS instances", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "monitoring_interval" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEnhancedMonitorEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_161", + "bc_check_id": "BC_AWS_IAM_65", + "check_name": "Ensure RDS database has IAM authentication enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "iam_database_authentication_enabled" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSIAMAuthentication", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_293", + "bc_check_id": "BC_AWS_GENERAL_208", + "check_name": "Ensure that AWS database instances have deletion protection enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "deletion_protection" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstanceDeletionProtection", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_17", + "bc_check_id": "BC_AWS_PUBLIC_2", + "check_name": "Ensure all data stored in RDS is not publicly accessible", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "publicly_accessible" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSPubliclyAccessible", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_16", + "bc_check_id": "BC_AWS_GENERAL_4", + "check_name": "Ensure all data stored in the RDS is securely encrypted at rest", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "storage_encrypted" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEncryption", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_129", + "bc_check_id": "BC_AWS_IAM_60", + "check_name": "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "enabled_cloudwatch_logs_exports/[0]" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceLogging", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_353", + "bc_check_id": "BC_AWS_LOGGING_47", + "check_name": "Ensure that RDS instances have performance insights enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "performance_insights_enabled" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstancePerformanceInsights", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-353", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_133", + "bc_check_id": "BC_AWS_GENERAL_46", + "check_name": "Ensure that RDS instances has backup policy", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "backup_retention_period" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceBackupRetentionPeriod", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-rds-instances-have-backup-policy", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_157", + "bc_check_id": "BC_AWS_GENERAL_73", + "check_name": "Ensure that RDS instances have Multi-AZ enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "multi_az" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSMultiAZEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_226", + "bc_check_id": "BC_AWS_GENERAL_121", + "check_name": "Ensure DB instance gets all minor upgrades automatically", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "auto_minor_version_upgrade" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceMinorUpgrade", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_118", + "bc_check_id": "BC_AWS_LOGGING_28", + "check_name": "Ensure that enhanced monitoring is enabled for Amazon RDS instances", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "monitoring_interval" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSEnhancedMonitorEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_161", + "bc_check_id": "BC_AWS_IAM_65", + "check_name": "Ensure RDS database has IAM authentication enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "iam_database_authentication_enabled" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSIAMAuthentication", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_293", + "bc_check_id": "BC_AWS_GENERAL_208", + "check_name": "Ensure that AWS database instances have deletion protection enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "deletion_protection" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSInstanceDeletionProtection", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-293", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_129", + "bc_check_id": "BC_AWS_IAM_60", + "check_name": "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "enabled_cloudwatch_logs_exports/[0]" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceLogging", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_157", + "bc_check_id": "BC_AWS_GENERAL_73", + "check_name": "Ensure that RDS instances have Multi-AZ enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "multi_az" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.RDSMultiAZEnabled", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_226", + "bc_check_id": "BC_AWS_GENERAL_121", + "check_name": "Ensure DB instance gets all minor upgrades automatically", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "auto_minor_version_upgrade" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DBInstanceMinorUpgrade", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_28", + "bc_check_id": "BC_AWS_GENERAL_6", + "check_name": "Ensure DynamoDB point in time recovery (backup) is enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "point_in_time_recovery/[0]/enabled" + ] + }, + "code_block": [ + [ + 72, + "resource \"aws_dynamodb_table\" \"unencrypted_table\" {\n" + ], + [ + 73, + " name = \"my-table\"\n" + ], + [ + 74, + " billing_mode = \"PAY_PER_REQUEST\"\n" + ], + [ + 75, + " hash_key = \"id\"\n" + ], + [ + 76, + "\n" + ], + [ + 77, + " attribute {\n" + ], + [ + 78, + " name = \"id\"\n" + ], + [ + 79, + " type = \"S\"\n" + ], + [ + 80, + " }\n" + ], + [ + 81, + "\n" + ], + [ + 82, + " # No server_side_encryption configuration!\n" + ], + [ + 83, + " \n" + ], + [ + 84, + " # No point-in-time recovery\n" + ], + [ + 85, + " point_in_time_recovery {\n" + ], + [ + 86, + " enabled = false # SECURITY ISSUE #17\n" + ], + [ + 87, + " }\n" + ], + [ + 88, + "\n" + ], + [ + 89, + " tags = {\n" + ], + [ + 90, + " Name = \"Unencrypted DynamoDB Table\"\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 72, + 92 + ], + "resource": "aws_dynamodb_table.unencrypted_table", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DynamodbRecovery", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted DynamoDB Table" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-6", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_119", + "bc_check_id": "BC_AWS_GENERAL_52", + "check_name": "Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "server_side_encryption/[0]/enabled", + "server_side_encryption/[0]/kms_key_arn" + ] + }, + "code_block": [ + [ + 72, + "resource \"aws_dynamodb_table\" \"unencrypted_table\" {\n" + ], + [ + 73, + " name = \"my-table\"\n" + ], + [ + 74, + " billing_mode = \"PAY_PER_REQUEST\"\n" + ], + [ + 75, + " hash_key = \"id\"\n" + ], + [ + 76, + "\n" + ], + [ + 77, + " attribute {\n" + ], + [ + 78, + " name = \"id\"\n" + ], + [ + 79, + " type = \"S\"\n" + ], + [ + 80, + " }\n" + ], + [ + 81, + "\n" + ], + [ + 82, + " # No server_side_encryption configuration!\n" + ], + [ + 83, + " \n" + ], + [ + 84, + " # No point-in-time recovery\n" + ], + [ + 85, + " point_in_time_recovery {\n" + ], + [ + 86, + " enabled = false # SECURITY ISSUE #17\n" + ], + [ + 87, + " }\n" + ], + [ + 88, + "\n" + ], + [ + 89, + " tags = {\n" + ], + [ + 90, + " Name = \"Unencrypted DynamoDB Table\"\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 72, + 92 + ], + "resource": "aws_dynamodb_table.unencrypted_table", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.DynamoDBTablesEncrypted", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted DynamoDB Table" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-52", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_63", + "bc_check_id": "BC_AWS_IAM_48", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarActionPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-48", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_62", + "bc_check_id": "BC_AWS_IAM_47", + "check_name": "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy", + "inline_policy" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMAdminPolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-45", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 39, + "resource \"aws_iam_role_policy\" \"s3_full_access\" {\n" + ], + [ + 40, + " name = \"s3-full-access\"\n" + ], + [ + 41, + " role = aws_iam_role.app_role.id\n" + ], + [ + 42, + "\n" + ], + [ + 43, + " policy = jsonencode({\n" + ], + [ + 44, + " Version = \"2012-10-17\"\n" + ], + [ + 45, + " Statement = [\n" + ], + [ + 46, + " {\n" + ], + [ + 47, + " Effect = \"Allow\"\n" + ], + [ + 48, + " Action = [\n" + ], + [ + 49, + " \"s3:*\" # All S3 actions!\n" + ], + [ + 50, + " ]\n" + ], + [ + 51, + " Resource = \"*\" # On all buckets!\n" + ], + [ + 52, + " }\n" + ], + [ + 53, + " ]\n" + ], + [ + 54, + " })\n" + ], + [ + 55, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 39, + 55 + ], + "resource": "aws_iam_role_policy.s3_full_access", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_273", + "bc_check_id": "BC_AWS_IAM_77", + "check_name": "Ensure access is controlled through SSO and not AWS IAM defined users", + "check_result": { + "result": "FAILED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 58, + "resource \"aws_iam_user\" \"service_account\" {\n" + ], + [ + 59, + " name = \"service-account\"\n" + ], + [ + 60, + " path = \"/system/\"\n" + ], + [ + 61, + "\n" + ], + [ + 62, + " tags = {\n" + ], + [ + 63, + " Name = \"Service Account\"\n" + ], + [ + 64, + " }\n" + ], + [ + 65, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 58, + 65 + ], + "resource": "aws_iam_user.service_account", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMUserNotUsedForAccess", + "fixed_definition": null, + "entity_tags": { + "Name": "Service Account" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-273", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_40", + "bc_check_id": "BC_AWS_IAM_16", + "check_name": "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "user" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPolicyAttachedToGroupOrRoles", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-16-iam-policy-privileges-1", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_290", + "bc_check_id": "BC_AWS_IAM_85", + "check_name": "Ensure IAM policies does not allow write access without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMWriteAccess", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-290", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_287", + "bc_check_id": "BC_AWS_IAM_82", + "check_name": "Ensure IAM policies does not allow credentials exposure", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMCredentialsExposure", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-287", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_288", + "bc_check_id": "BC_AWS_IAM_83", + "check_name": "Ensure IAM policies does not allow data exfiltration", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 67, + "resource \"aws_iam_user_policy\" \"service_policy\" {\n" + ], + [ + 68, + " name = \"service-inline-policy\"\n" + ], + [ + 69, + " user = aws_iam_user.service_account.name\n" + ], + [ + 70, + "\n" + ], + [ + 71, + " policy = jsonencode({\n" + ], + [ + 72, + " Version = \"2012-10-17\"\n" + ], + [ + 73, + " Statement = [\n" + ], + [ + 74, + " {\n" + ], + [ + 75, + " Effect = \"Allow\"\n" + ], + [ + 76, + " Action = [\n" + ], + [ + 77, + " \"ec2:*\", # Full EC2 access\n" + ], + [ + 78, + " \"s3:*\", # Full S3 access\n" + ], + [ + 79, + " \"rds:*\" # Full RDS access\n" + ], + [ + 80, + " ]\n" + ], + [ + 81, + " Resource = \"*\"\n" + ], + [ + 82, + " }\n" + ], + [ + 83, + " ]\n" + ], + [ + 84, + " })\n" + ], + [ + 85, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 67, + 85 + ], + "resource": "aws_iam_user_policy.service_policy", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMDataExfiltration", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-288", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf", + "breadcrumbs": { + "user": [ + { + "type": "resource", + "name": "aws_iam_user.service_account", + "path": "/tf/iam.tf", + "module_connection": false + } + ] + } + }, + { + "check_id": "CKV_AWS_286", + "bc_check_id": "BC_AWS_IAM_81", + "check_name": "Ensure IAM policies does not allow privilege escalation", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPrivilegeEscalation", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-286", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_289", + "bc_check_id": "BC_AWS_IAM_84", + "check_name": "Ensure IAM policies does not allow permissions management / resource exposure without constraints", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMPermissionsManagement", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-289", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_355", + "bc_check_id": "BC_AWS_IAM_88", + "check_name": "Ensure no IAM policies documents allow \"*\" as a statement's resource for restrictable actions", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "policy/Statement/[0]/Action" + ] + }, + "code_block": [ + [ + 104, + "resource \"aws_iam_policy\" \"privilege_escalation\" {\n" + ], + [ + 105, + " name = \"potential-privilege-escalation\"\n" + ], + [ + 106, + " description = \"Policy that allows privilege escalation\"\n" + ], + [ + 107, + "\n" + ], + [ + 108, + " policy = jsonencode({\n" + ], + [ + 109, + " Version = \"2012-10-17\"\n" + ], + [ + 110, + " Statement = [\n" + ], + [ + 111, + " {\n" + ], + [ + 112, + " Effect = \"Allow\"\n" + ], + [ + 113, + " Action = [\n" + ], + [ + 114, + " \"iam:CreatePolicy\",\n" + ], + [ + 115, + " \"iam:CreateUser\",\n" + ], + [ + 116, + " \"iam:AttachUserPolicy\",\n" + ], + [ + 117, + " \"iam:AttachRolePolicy\",\n" + ], + [ + 118, + " \"iam:PutUserPolicy\",\n" + ], + [ + 119, + " \"iam:PutRolePolicy\"\n" + ], + [ + 120, + " ]\n" + ], + [ + 121, + " Resource = \"*\"\n" + ], + [ + 122, + " }\n" + ], + [ + 123, + " ]\n" + ], + [ + 124, + " })\n" + ], + [ + 125, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 104, + 125 + ], + "resource": "aws_iam_policy.privilege_escalation", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.IAMStarResourcePolicyDocument", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-355", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + }, + { + "check_id": "CKV_AWS_41", + "bc_check_id": "BC_AWS_SECRETS_5", + "check_name": "Ensure no hard coded AWS access key and secret key exists in provider", + "check_result": { + "result": "FAILED", + "evaluated_keys": [] + }, + "code_block": [ + [ + 5, + "provider \"aws\" {\n" + ], + [ + 6, + " region = \"us-east-1\"\n" + ], + [ + 7, + " # Hardcoded credentials - SECURITY ISSUE #1\n" + ], + [ + 8, + " access_key = \"AKIAI**********\"\n" + ], + [ + 9, + " secret_key = \"wJalrX**********\"\n" + ], + [ + 10, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 5, + 10 + ], + "resource": "aws.default", + "evaluations": null, + "check_class": "checkov.terraform.checks.provider.aws.credentials", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_55", + "bc_check_id": "BC_AWS_S3_21", + "check_name": "Ensure S3 bucket has ignore public ACLs enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ignore_public_acls" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3IgnorePublicACLs", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-21", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_56", + "bc_check_id": "BC_AWS_S3_22", + "check_name": "Ensure S3 bucket has 'restrict_public_buckets' enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "restrict_public_buckets" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3RestrictPublicBuckets", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-22", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_54", + "bc_check_id": "BC_AWS_S3_20", + "check_name": "Ensure S3 bucket has block public policy enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "block_public_policy" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3BlockPublicPolicy", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-20", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_53", + "bc_check_id": "BC_AWS_S3_19", + "check_name": "Ensure S3 bucket has block public ACLS enabled", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "block_public_acls" + ] + }, + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.S3BlockPublicACLs", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-19", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_24", + "bc_check_id": "BC_AWS_NETWORKING_1", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress22", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_23", + "bc_check_id": "BC_AWS_NETWORKING_31", + "check_name": "Ensure every security group and rule has a description", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "description", + "egress/[0]" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupRuleDescription", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_260", + "bc_check_id": "BC_AWS_NETWORKING_67", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 80", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress80", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-groups-do-not-allow-ingress-from-00000-to-port-80", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_277", + "bc_check_id": "BC_AWS_NETWORKING_78", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_382", + "bc_check_id": "BC_AWS_IAM_93", + "check_name": "Ensure no security groups allow egress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "egress/[0]/from_port", + "egress/[0]/to_port", + "egress/[0]/cidr_blocks", + "egress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedEgressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_25", + "bc_check_id": "BC_AWS_NETWORKING_2", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress3389", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_24", + "bc_check_id": "BC_AWS_NETWORKING_1", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[0]/from_port", + "ingress/[0]/to_port", + "ingress/[0]/cidr_blocks", + "ingress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress22", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-1-port-security", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_23", + "bc_check_id": "BC_AWS_NETWORKING_31", + "check_name": "Ensure every security group and rule has a description", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "description", + "egress/[0]" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupRuleDescription", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_382", + "bc_check_id": "BC_AWS_IAM_93", + "check_name": "Ensure no security groups allow egress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "egress/[0]/from_port", + "egress/[0]/to_port", + "egress/[0]/cidr_blocks", + "egress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedEgressAny", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_25", + "bc_check_id": "BC_AWS_NETWORKING_2", + "check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "ingress/[1]/from_port", + "ingress/[1]/to_port", + "ingress/[1]/cidr_blocks", + "ingress/[1]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress3389", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-2", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_23", + "bc_check_id": "BC_AWS_NETWORKING_31", + "check_name": "Ensure every security group and rule has a description", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "description", + "egress/[0]" + ] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupRuleDescription", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/networking-31", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV_AWS_382", + "bc_check_id": "BC_AWS_IAM_93", + "check_name": "Ensure no security groups allow egress from 0.0.0.0:0 to port -1", + "check_result": { + "result": "FAILED", + "evaluated_keys": [ + "egress/[0]/from_port", + "egress/[0]/to_port", + "egress/[0]/cidr_blocks", + "egress/[0]/ipv6_cidr_blocks" + ] + }, + "code_block": [ + [ + 65, + "resource \"aws_security_group\" \"database_exposed\" {\n" + ], + [ + 66, + " name = \"database-public\"\n" + ], + [ + 67, + " description = \"Database accessible from internet\"\n" + ], + [ + 68, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 69, + "\n" + ], + [ + 70, + " ingress {\n" + ], + [ + 71, + " description = \"MySQL from anywhere\"\n" + ], + [ + 72, + " from_port = 3306\n" + ], + [ + 73, + " to_port = 3306\n" + ], + [ + 74, + " protocol = \"tcp\"\n" + ], + [ + 75, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 76, + " }\n" + ], + [ + 77, + "\n" + ], + [ + 78, + " ingress {\n" + ], + [ + 79, + " description = \"PostgreSQL from anywhere\"\n" + ], + [ + 80, + " from_port = 5432\n" + ], + [ + 81, + " to_port = 5432\n" + ], + [ + 82, + " protocol = \"tcp\"\n" + ], + [ + 83, + " cidr_blocks = [\"0.0.0.0/0\"] # Database exposed!\n" + ], + [ + 84, + " }\n" + ], + [ + 85, + "\n" + ], + [ + 86, + " egress {\n" + ], + [ + 87, + " from_port = 0\n" + ], + [ + 88, + " to_port = 0\n" + ], + [ + 89, + " protocol = \"-1\"\n" + ], + [ + 90, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 91, + " }\n" + ], + [ + 92, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 65, + 92 + ], + "resource": "aws_security_group.database_exposed", + "evaluations": null, + "check_class": "checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedEgressAny", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/bc-aws-382", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV2_AWS_30", + "bc_check_id": "BC_AWS_LOGGING_32", + "check_name": "Ensure Postgres RDS as aws_db_instance has Query Logging enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_db_instance": { + "unencrypted_db": { + "__end_line__": 37, + "__start_line__": 5, + "allocated_storage": [ + 20 + ], + "backup_retention_period": [ + 0 + ], + "deletion_protection": [ + false + ], + "enabled_cloudwatch_logs_exports": [ + [] + ], + "engine": [ + "postgres" + ], + "engine_version": [ + "13.7" + ], + "identifier": [ + "mydb-unencrypted" + ], + "instance_class": [ + "db.t3.micro" + ], + "password": [ + "SuperSecretPassword123!" + ], + "publicly_accessible": [ + true + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + false + ], + "tags": [ + { + "Name": "Unencrypted Database" + } + ], + "username": [ + "admin" + ], + "vpc_security_group_ids": [ + [ + "aws_security_group.database_exposed.id" + ] + ], + "__address__": "aws_db_instance.unencrypted_db" + } + } + }, + "evaluated_keys": [ + "resource_type", + "parameter/*/name", + "engine" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-postgres-rds-has-query-logging-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_21", + "bc_check_id": "BC_AWS_S3_16", + "check_name": "Ensure all data stored in the S3 bucket have versioning enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "versioning/enabled", + "versioning_configuration/status" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_21", + "bc_check_id": "BC_AWS_S3_16", + "check_name": "Ensure all data stored in the S3 bucket have versioning enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "versioning/enabled", + "versioning_configuration/status" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_61", + "bc_check_id": "BC_AWS_LOGGING_35", + "check_name": "Ensure that an S3 bucket has a lifecycle configuration", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "lifecycle_rule" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_61", + "bc_check_id": "BC_AWS_LOGGING_35", + "check_name": "Ensure that an S3 bucket has a lifecycle configuration", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "lifecycle_rule" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_18", + "bc_check_id": "BC_AWS_S3_13", + "check_name": "Ensure the S3 bucket has access logging enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "logging" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_18", + "bc_check_id": "BC_AWS_S3_13", + "check_name": "Ensure the S3 bucket has access logging enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "logging" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_144", + "bc_check_id": "BC_AWS_GENERAL_72", + "check_name": "Ensure that S3 bucket has cross-region replication enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "rule/*/status", + "replication_configuration/rules/*/status" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_144", + "bc_check_id": "BC_AWS_GENERAL_72", + "check_name": "Ensure that S3 bucket has cross-region replication enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "rule/*/status", + "replication_configuration/rules/*/status" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_5", + "bc_check_id": "BC_AWS_NETWORKING_51", + "check_name": "Ensure that Security Groups are attached to another resource", + "check_result": { + "result": "FAILED", + "entity": { + "aws_security_group": { + "allow_all": { + "__end_line__": 28, + "__start_line__": 5, + "description": [ + "Allow all inbound traffic from anywhere" + ], + "egress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 0 + ] + } + ], + "ingress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "Allow all traffic" + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 65535 + ] + } + ], + "name": [ + "allow-all-traffic" + ], + "tags": [ + { + "Name": "Allow All Security Group" + } + ], + "vpc_id": [ + "vpc-12345678" + ], + "__address__": "aws_security_group.allow_all" + } + } + }, + "evaluated_keys": [ + "resource_type", + "networking" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_security_group\" \"allow_all\" {\n" + ], + [ + 6, + " name = \"allow-all-traffic\"\n" + ], + [ + 7, + " description = \"Allow all inbound traffic from anywhere\"\n" + ], + [ + 8, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 9, + "\n" + ], + [ + 10, + " ingress {\n" + ], + [ + 11, + " description = \"Allow all traffic\"\n" + ], + [ + 12, + " from_port = 0\n" + ], + [ + 13, + " to_port = 65535\n" + ], + [ + 14, + " protocol = \"-1\" # All protocols\n" + ], + [ + 15, + " cidr_blocks = [\"0.0.0.0/0\"] # From anywhere!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + "\n" + ], + [ + 18, + " egress {\n" + ], + [ + 19, + " from_port = 0\n" + ], + [ + 20, + " to_port = 0\n" + ], + [ + 21, + " protocol = \"-1\"\n" + ], + [ + 22, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 23, + " }\n" + ], + [ + 24, + "\n" + ], + [ + 25, + " tags = {\n" + ], + [ + 26, + " Name = \"Allow All Security Group\"\n" + ], + [ + 27, + " }\n" + ], + [ + 28, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 5, + 28 + ], + "resource": "aws_security_group.allow_all", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Allow All Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV2_AWS_5", + "bc_check_id": "BC_AWS_NETWORKING_51", + "check_name": "Ensure that Security Groups are attached to another resource", + "check_result": { + "result": "FAILED", + "entity": { + "aws_security_group": { + "ssh_open": { + "__end_line__": 62, + "__start_line__": 31, + "description": [ + "SSH access from anywhere" + ], + "egress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "from_port": [ + 0 + ], + "protocol": [ + "-1" + ], + "to_port": [ + 0 + ] + } + ], + "ingress": [ + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "SSH from anywhere" + ], + "from_port": [ + 22 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 22 + ] + }, + { + "cidr_blocks": [ + [ + "0.0.0.0/0" + ] + ], + "description": [ + "RDP from anywhere" + ], + "from_port": [ + 3389 + ], + "protocol": [ + "tcp" + ], + "to_port": [ + 3389 + ] + } + ], + "name": [ + "ssh-from-anywhere" + ], + "tags": [ + { + "Name": "SSH Open Security Group" + } + ], + "vpc_id": [ + "vpc-12345678" + ], + "__address__": "aws_security_group.ssh_open" + } + } + }, + "evaluated_keys": [ + "resource_type", + "networking" + ] + }, + "code_block": [ + [ + 31, + "resource \"aws_security_group\" \"ssh_open\" {\n" + ], + [ + 32, + " name = \"ssh-from-anywhere\"\n" + ], + [ + 33, + " description = \"SSH access from anywhere\"\n" + ], + [ + 34, + " vpc_id = \"vpc-12345678\"\n" + ], + [ + 35, + "\n" + ], + [ + 36, + " ingress {\n" + ], + [ + 37, + " description = \"SSH from anywhere\"\n" + ], + [ + 38, + " from_port = 22\n" + ], + [ + 39, + " to_port = 22\n" + ], + [ + 40, + " protocol = \"tcp\"\n" + ], + [ + 41, + " cidr_blocks = [\"0.0.0.0/0\"] # SSH from anywhere!\n" + ], + [ + 42, + " }\n" + ], + [ + 43, + "\n" + ], + [ + 44, + " ingress {\n" + ], + [ + 45, + " description = \"RDP from anywhere\"\n" + ], + [ + 46, + " from_port = 3389\n" + ], + [ + 47, + " to_port = 3389\n" + ], + [ + 48, + " protocol = \"tcp\"\n" + ], + [ + 49, + " cidr_blocks = [\"0.0.0.0/0\"] # RDP from anywhere!\n" + ], + [ + 50, + " }\n" + ], + [ + 51, + "\n" + ], + [ + 52, + " egress {\n" + ], + [ + 53, + " from_port = 0\n" + ], + [ + 54, + " to_port = 0\n" + ], + [ + 55, + " protocol = \"-1\"\n" + ], + [ + 56, + " cidr_blocks = [\"0.0.0.0/0\"]\n" + ], + [ + 57, + " }\n" + ], + [ + 58, + "\n" + ], + [ + 59, + " tags = {\n" + ], + [ + 60, + " Name = \"SSH Open Security Group\"\n" + ], + [ + 61, + " }\n" + ], + [ + 62, + "}\n" + ] + ], + "file_path": "/security_groups.tf", + "file_abs_path": "/tf/security_groups.tf", + "repo_file_path": "/tf/security_groups.tf", + "file_line_range": [ + 31, + 62 + ], + "resource": "aws_security_group.ssh_open", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "SSH Open Security Group" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/security_groups.tf" + }, + { + "check_id": "CKV2_AWS_62", + "bc_check_id": "BC_AWS_LOGGING_36", + "check_name": "Ensure S3 buckets should have event notifications enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_62", + "bc_check_id": "BC_AWS_LOGGING_36", + "check_name": "Ensure S3 buckets should have event notifications enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_60", + "bc_check_id": "BC_AWS_GENERAL_195", + "check_name": "Ensure RDS instance with copy tags to snapshots is enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_db_instance": { + "unencrypted_db": { + "__end_line__": 37, + "__start_line__": 5, + "allocated_storage": [ + 20 + ], + "backup_retention_period": [ + 0 + ], + "deletion_protection": [ + false + ], + "enabled_cloudwatch_logs_exports": [ + [] + ], + "engine": [ + "postgres" + ], + "engine_version": [ + "13.7" + ], + "identifier": [ + "mydb-unencrypted" + ], + "instance_class": [ + "db.t3.micro" + ], + "password": [ + "SuperSecretPassword123!" + ], + "publicly_accessible": [ + true + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + false + ], + "tags": [ + { + "Name": "Unencrypted Database" + } + ], + "username": [ + "admin" + ], + "vpc_security_group_ids": [ + [ + "aws_security_group.database_exposed.id" + ] + ], + "__address__": "aws_db_instance.unencrypted_db" + } + } + }, + "evaluated_keys": [ + "engine", + "copy_tags_to_snapshot" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_db_instance\" \"unencrypted_db\" {\n" + ], + [ + 6, + " identifier = \"mydb-unencrypted\"\n" + ], + [ + 7, + " engine = \"postgres\"\n" + ], + [ + 8, + " engine_version = \"13.7\"\n" + ], + [ + 9, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 10, + " allocated_storage = 20\n" + ], + [ + 11, + " \n" + ], + [ + 12, + " username = \"admin\"\n" + ], + [ + 13, + " password = \"SuperSecretPassword123!\" # SECURITY ISSUE #9 - Hardcoded password!\n" + ], + [ + 14, + " \n" + ], + [ + 15, + " storage_encrypted = false # No encryption!\n" + ], + [ + 16, + " \n" + ], + [ + 17, + " publicly_accessible = true # SECURITY ISSUE #10 - Public access!\n" + ], + [ + 18, + " \n" + ], + [ + 19, + " skip_final_snapshot = true\n" + ], + [ + 20, + " \n" + ], + [ + 21, + " # No backup configuration\n" + ], + [ + 22, + " backup_retention_period = 0 # SECURITY ISSUE #11 - No backups!\n" + ], + [ + 23, + " \n" + ], + [ + 24, + " # Missing monitoring\n" + ], + [ + 25, + " enabled_cloudwatch_logs_exports = []\n" + ], + [ + 26, + " \n" + ], + [ + 27, + " # No deletion protection\n" + ], + [ + 28, + " deletion_protection = false # SECURITY ISSUE #12\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " # Using default security group\n" + ], + [ + 31, + " vpc_security_group_ids = [aws_security_group.database_exposed.id]\n" + ], + [ + 32, + " \n" + ], + [ + 33, + " tags = {\n" + ], + [ + 34, + " Name = \"Unencrypted Database\"\n" + ], + [ + 35, + " # Missing required tags\n" + ], + [ + 36, + " }\n" + ], + [ + 37, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 5, + 37 + ], + "resource": "aws_db_instance.unencrypted_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Unencrypted Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV2_AWS_60", + "bc_check_id": "BC_AWS_GENERAL_195", + "check_name": "Ensure RDS instance with copy tags to snapshots is enabled", + "check_result": { + "result": "FAILED", + "entity": { + "aws_db_instance": { + "weak_db": { + "__end_line__": 69, + "__start_line__": 40, + "allocated_storage": [ + 20 + ], + "auto_minor_version_upgrade": [ + false + ], + "engine": [ + "mysql" + ], + "engine_version": [ + "5.7.38" + ], + "identifier": [ + "mydb-weak" + ], + "instance_class": [ + "db.t3.micro" + ], + "kms_key_id": [ + "" + ], + "multi_az": [ + false + ], + "password": [ + "password123" + ], + "performance_insights_enabled": [ + false + ], + "publicly_accessible": [ + false + ], + "skip_final_snapshot": [ + true + ], + "storage_encrypted": [ + true + ], + "tags": [ + { + "Name": "Weak Database" + } + ], + "username": [ + "root" + ], + "__address__": "aws_db_instance.weak_db" + } + } + }, + "evaluated_keys": [ + "engine", + "copy_tags_to_snapshot" + ] + }, + "code_block": [ + [ + 40, + "resource \"aws_db_instance\" \"weak_db\" {\n" + ], + [ + 41, + " identifier = \"mydb-weak\"\n" + ], + [ + 42, + " engine = \"mysql\"\n" + ], + [ + 43, + " engine_version = \"5.7.38\" # Old version with known vulnerabilities\n" + ], + [ + 44, + " instance_class = \"db.t3.micro\"\n" + ], + [ + 45, + " allocated_storage = 20\n" + ], + [ + 46, + " \n" + ], + [ + 47, + " username = \"root\" # Using default admin username\n" + ], + [ + 48, + " password = \"password123\" # Weak password!\n" + ], + [ + 49, + " \n" + ], + [ + 50, + " storage_encrypted = true\n" + ], + [ + 51, + " kms_key_id = \"\" # Empty KMS key - using default key\n" + ], + [ + 52, + " \n" + ], + [ + 53, + " publicly_accessible = false\n" + ], + [ + 54, + " \n" + ], + [ + 55, + " # Multi-AZ disabled\n" + ], + [ + 56, + " multi_az = false # SECURITY ISSUE #14 - No high availability\n" + ], + [ + 57, + " \n" + ], + [ + 58, + " # Auto minor version upgrade disabled\n" + ], + [ + 59, + " auto_minor_version_upgrade = false # SECURITY ISSUE #15\n" + ], + [ + 60, + " \n" + ], + [ + 61, + " # No performance insights\n" + ], + [ + 62, + " performance_insights_enabled = false\n" + ], + [ + 63, + " \n" + ], + [ + 64, + " skip_final_snapshot = true\n" + ], + [ + 65, + " \n" + ], + [ + 66, + " tags = {\n" + ], + [ + 67, + " Name = \"Weak Database\"\n" + ], + [ + 68, + " }\n" + ], + [ + 69, + "}\n" + ] + ], + "file_path": "/database.tf", + "file_abs_path": "/tf/database.tf", + "repo_file_path": "/tf/database.tf", + "file_line_range": [ + 40, + 69 + ], + "resource": "aws_db_instance.weak_db", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Weak Database" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/database.tf" + }, + { + "check_id": "CKV_AWS_20", + "bc_check_id": "BC_AWS_S3_1", + "check_name": "S3 Bucket has an ACL defined which allows public READ access.", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "access_control_policy/grant/*/grantee/uri", + "access_control_policy/grant", + "resource_type", + "access_control_policy", + "acl" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_145", + "bc_check_id": "BC_AWS_GENERAL_56", + "check_name": "Ensure that S3 buckets are encrypted with KMS by default", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV_AWS_145", + "bc_check_id": "BC_AWS_GENERAL_56", + "check_name": "Ensure that S3 buckets are encrypted with KMS by default", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm", + "rule/apply_server_side_encryption_by_default/sse_algorithm" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_6", + "bc_check_id": "BC_AWS_NETWORKING_52", + "check_name": "Ensure that S3 bucket has a Public Access block", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "public_data": { + "__end_line__": 21, + "__start_line__": 13, + "acl": [ + "public-read" + ], + "bucket": [ + "my-public-bucket-lab6" + ], + "tags": [ + { + "Name": "Public Data Bucket" + } + ], + "__address__": "aws_s3_bucket.public_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "block_public_policy", + "block_public_acls" + ] + }, + "code_block": [ + [ + 13, + "resource \"aws_s3_bucket\" \"public_data\" {\n" + ], + [ + 14, + " bucket = \"my-public-bucket-lab6\"\n" + ], + [ + 15, + " acl = \"public-read\" # Public access enabled!\n" + ], + [ + 16, + "\n" + ], + [ + 17, + " tags = {\n" + ], + [ + 18, + " Name = \"Public Data Bucket\"\n" + ], + [ + 19, + " # Missing required tags: Environment, Owner, CostCenter\n" + ], + [ + 20, + " }\n" + ], + [ + 21, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 13, + 21 + ], + "resource": "aws_s3_bucket.public_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": { + "Name": "Public Data Bucket" + }, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": { + "code_block": [ + [ + 36, + "resource \"aws_s3_bucket_public_access_block\" \"bad_config\" {\n" + ], + [ + 37, + " bucket = aws_s3_bucket.public_data.id\n" + ], + [ + 38, + "\n" + ], + [ + 39, + " block_public_acls = false # Should be true\n" + ], + [ + 40, + " block_public_policy = false # Should be true\n" + ], + [ + 41, + " ignore_public_acls = false # Should be true\n" + ], + [ + 42, + " restrict_public_buckets = false # Should be true\n" + ], + [ + 43, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_line_range": [ + 36, + 43 + ], + "resource": "aws_s3_bucket_public_access_block.bad_config", + "entity_tags": {}, + "evaluations": null, + "file_abs_path": "/tf/main.tf", + "resource_address": null + }, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_6", + "bc_check_id": "BC_AWS_NETWORKING_52", + "check_name": "Ensure that S3 bucket has a Public Access block", + "check_result": { + "result": "FAILED", + "entity": { + "aws_s3_bucket": { + "unencrypted_data": { + "__end_line__": 33, + "__start_line__": 24, + "acl": [ + "private" + ], + "bucket": [ + "my-unencrypted-bucket-lab6" + ], + "versioning": [ + { + "enabled": [ + false + ] + } + ], + "__address__": "aws_s3_bucket.unencrypted_data", + "__provider_address__": "aws.default" + } + } + }, + "evaluated_keys": [ + "resource_type", + "block_public_policy", + "block_public_acls" + ] + }, + "code_block": [ + [ + 24, + "resource \"aws_s3_bucket\" \"unencrypted_data\" {\n" + ], + [ + 25, + " bucket = \"my-unencrypted-bucket-lab6\"\n" + ], + [ + 26, + " acl = \"private\"\n" + ], + [ + 27, + " \n" + ], + [ + 28, + " # No server_side_encryption_configuration!\n" + ], + [ + 29, + " \n" + ], + [ + 30, + " versioning {\n" + ], + [ + 31, + " enabled = false # Versioning disabled\n" + ], + [ + 32, + " }\n" + ], + [ + 33, + "}\n" + ] + ], + "file_path": "/main.tf", + "file_abs_path": "/tf/main.tf", + "repo_file_path": "/tf/main.tf", + "file_line_range": [ + 24, + 33 + ], + "resource": "aws_s3_bucket.unencrypted_data", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/main.tf" + }, + { + "check_id": "CKV2_AWS_40", + "bc_check_id": "BC_AWS_IAM_73", + "check_name": "Ensure AWS IAM policy does not allow full IAM privileges", + "check_result": { + "result": "FAILED", + "entity": { + "aws_iam_policy": { + "admin_policy": { + "__end_line__": 19, + "__start_line__": 5, + "description": [ + "Policy with wildcard permissions" + ], + "name": [ + "overly-permissive-policy" + ], + "policy": [ + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "*", + "Resource": "*" + } + ] + } + ], + "__address__": "aws_iam_policy.admin_policy" + } + } + }, + "evaluated_keys": [ + "policy/Statement[?(@/Effect == Allow)]/Action[*]", + "inline_policy/Statement[?(@/Effect == Allow)]/Action[*]", + "statement[?(@/effect == Allow)]/actions[*]" + ] + }, + "code_block": [ + [ + 5, + "resource \"aws_iam_policy\" \"admin_policy\" {\n" + ], + [ + 6, + " name = \"overly-permissive-policy\"\n" + ], + [ + 7, + " description = \"Policy with wildcard permissions\"\n" + ], + [ + 8, + "\n" + ], + [ + 9, + " policy = jsonencode({\n" + ], + [ + 10, + " Version = \"2012-10-17\"\n" + ], + [ + 11, + " Statement = [\n" + ], + [ + 12, + " {\n" + ], + [ + 13, + " Effect = \"Allow\"\n" + ], + [ + 14, + " Action = \"*\" # All actions allowed!\n" + ], + [ + 15, + " Resource = \"*\" # On all resources!\n" + ], + [ + 16, + " }\n" + ], + [ + 17, + " ]\n" + ], + [ + 18, + " })\n" + ], + [ + 19, + "}\n" + ] + ], + "file_path": "/iam.tf", + "file_abs_path": "/tf/iam.tf", + "repo_file_path": "/tf/iam.tf", + "file_line_range": [ + 5, + 19 + ], + "resource": "aws_iam_policy.admin_policy", + "evaluations": null, + "check_class": "checkov.common.graph.checks_infra.base_check", + "fixed_definition": null, + "entity_tags": null, + "caller_file_path": null, + "caller_file_line_range": null, + "resource_address": null, + "severity": null, + "bc_category": null, + "benchmarks": null, + "description": null, + "short_description": null, + "vulnerability_details": null, + "connected_node": null, + "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-2-40", + "details": [], + "check_len": null, + "definition_context_file_path": "/tf/iam.tf" + } + ], + "skipped_checks": [], + "parsing_errors": [] + }, + "summary": { + "passed": 48, + "failed": 78, + "skipped": 0, + "parsing_errors": 0, + "resource_count": 16, + "checkov_version": "3.2.508" + }, + "url": "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud" +} diff --git a/labs/lab6/analysis/kics-ansible-report.html b/labs/lab6/analysis/kics-ansible-report.html new file mode 100755 index 00000000..0215166f --- /dev/null +++ b/labs/lab6/analysis/kics-ansible-report.html @@ -0,0 +1,52 @@ +KICS Scan ResultCheckmarx logo
KICS REPORT03/17/2026 08:14KICS.IO
KICS v2.1.20 +Scanned paths: /src +Platforms: Common, AnsibleStart time: 08:14:01, Mar 17 2026 +End time: 08:14:05, Mar 17 2026

Vulnerabilities:

0 +CRITICAL
9 +HIGH
0 +MEDIUM
1 +LOW
0 +INFO
10 +TOTAL

Passwords And Secrets - Generic Password

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (6)
File: ../../src/inventory.ini +Line 10
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
9# SECURITY ISSUE #36 - Using root user and default port
10db1.example.com ansible_user=root ansible_port=22 ansible_password=<SECRET-MASKED-ON-PURPOSE>
11
File: ../../src/inventory.ini +Line 19
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
18ansible_become_password=<SECRET-MASKED-ON-PURPOSE>
19db_admin_password=<SECRET-MASKED-ON-PURPOSE>
20api_secret_key=<SECRET-MASKED-ON-PURPOSE>
File: ../../src/inventory.ini +Line 18
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
17# SECURITY ISSUE #38 - Global variables with secrets
18ansible_become_password=<SECRET-MASKED-ON-PURPOSE>
19db_admin_password=<SECRET-MASKED-ON-PURPOSE>
File: ../../src/inventory.ini +Line 5
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
4[webservers]
5web1.example.com ansible_user=root ansible_password=<SECRET-MASKED-ON-PURPOSE>
6web2.example.com ansible_user=root ansible_ssh_pass=RootPass123!
File: ../../src/configure.yml +Line 16
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
15
16 admin_password: <SECRET-MASKED-ON-PURPOSE>
17
File: ../../src/deploy.yml +Line 12
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
11 # SECURITY ISSUE #1 - Hardcoded password in playbook!
12 db_password: <SECRET-MASKED-ON-PURPOSE>
13 # SECURITY ISSUE #2 - Hardcoded API key!

Passwords And Secrets - Generic Secret

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (1)
File: ../../src/inventory.ini +Line 20
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
19db_admin_password=<SECRET-MASKED-ON-PURPOSE>
20api_secret_key=<SECRET-MASKED-ON-PURPOSE>
21

Passwords And Secrets - Password in URL

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (2)
File: ../../src/deploy.yml +Line 16
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
15 # SECURITY ISSUE #3 - Database connection string with credentials
16 db_connection: <SECRET-MASKED-ON-PURPOSE>:5432/myapp"
17
File: ../../src/deploy.yml +Line 72
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
71 git:
72 repo: <SECRET-MASKED-ON-PURPOSE>/company/repo.git'
73 dest: /var/www/myapp

Unpinned Package Version

Platform: Ansible +CWE: 706 +Risk Score: 4.1 +Category: Supply-Chain
Setting state to latest performs an update and installs additional packages possibly resulting in performance degradation or loss of servicehttps://ansible.readthedocs.io/projects/lint/rules/package-latest/
Results (1)
File: ../../src/deploy.yml +Line 99
Expected: State's task when installing a package should not be defined as 'latest' or should have set 'update_only' to 'true' +Found: State's task is set to 'latest'
98 name: myapp
99 state: latest # Should pin specific version
100 update_cache: yes
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love:
The KICS project is powered by Checkmarx, global leader of Application Security Testing
\ No newline at end of file diff --git a/labs/lab6/analysis/kics-ansible-report.txt b/labs/lab6/analysis/kics-ansible-report.txt new file mode 100644 index 00000000..7994f3eb --- /dev/null +++ b/labs/lab6/analysis/kics-ansible-report.txt @@ -0,0 +1,53 @@ + + + + MLLLLLM MLLLLLLLLL LLLLLLL KLLLLLLLLLLLLLLLL LLLLLLLLLLLLLLLLLLLLLLL + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMML KLMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LMMMMMMMMML MMMMMMMK LMMMMMMMMMLLMLLLLLLLLLLLLLL LMMMMMMMLLLLLLLLLLLLLLLLLLLLM + MMMMMMM MMMMMMMMMLM MMMMMMMK LMMMMMMMM LMMMMMML + MMMMMMMLMMMMMMMML MMMMMMMK MMMMMMML LMMMMMMMMLLLLLLLLLLLLLMLL + MMMMMMMMMMMMMMMM MMMMMMMK MMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMMMMMMMMMMMMM MMMMMMMK MMMMMMM LMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM KLMMMMMMMMML MMMMMMMK LMMMMMMM MMMMMMMML + MMMMMMM LMMMMMMMMMM MMMMMMMK LMMMMMMMMLL MMMMMMML + MMMMMMM LMMMMMMMMMLL MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMMML LLLLLLLLLLLLLLLLLLLLMMMMMMMMMM + MMMMMMM MMMMMMMMMMML MMMMMMMK MMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LLMMMMMMMMML MMMMMMMK LLMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM MMMMMMMMMML MMMMMMMK KLMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMLK + + + + +Scanning with Keeping Infrastructure as Code Secure v2.1.20 + + + Preparing Scan Assets: Done + + + + +Unpinned Package Version, Severity: LOW, Results: 1 + [1]: ../../src/deploy.yml:99 +Passwords And Secrets - Password in URL, Severity: HIGH, Results: 2 + [1]: ../../src/deploy.yml:16 + [2]: ../../src/deploy.yml:72 +Passwords And Secrets - Generic Secret, Severity: HIGH, Results: 1 + [1]: ../../src/inventory.ini:20 +Passwords And Secrets - Generic Password, Severity: HIGH, Results: 6 + [1]: ../../src/deploy.yml:12 + [2]: ../../src/inventory.ini:19 + [3]: ../../src/configure.yml:16 + [4]: ../../src/inventory.ini:5 + [5]: ../../src/inventory.ini:10 + [6]: ../../src/inventory.ini:18 + +Results Summary: +CRITICAL: 0 +HIGH: 9 +MEDIUM: 0 +LOW: 1 +INFO: 0 +TOTAL: 10 + diff --git a/labs/lab6/analysis/kics-ansible-results.json b/labs/lab6/analysis/kics-ansible-results.json new file mode 100755 index 00000000..1a2c6be5 --- /dev/null +++ b/labs/lab6/analysis/kics-ansible-results.json @@ -0,0 +1,206 @@ +{ + "kics_version": "v2.1.20", + "files_scanned": 3, + "lines_scanned": 309, + "files_parsed": 3, + "lines_parsed": 260, + "lines_ignored": 49, + "files_failed_to_scan": 0, + "queries_total": 287, + "queries_failed_to_execute": 0, + "queries_failed_to_compute_similarity_id": 0, + "scan_id": "console", + "severity_counters": { + "CRITICAL": 0, + "HIGH": 9, + "INFO": 0, + "LOW": 1, + "MEDIUM": 0, + "TRACE": 0 + }, + "total_counter": 10, + "total_bom_resources": 0, + "start": "2026-03-17T08:14:01.992721409Z", + "end": "2026-03-17T08:14:05.899056792Z", + "paths": [ + "/src" + ], + "queries": [ + { + "query_name": "Passwords And Secrets - Generic Password", + "query_id": "487f4be7-3fd9-4506-a07a-eae252180c08", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/inventory.ini", + "similarity_id": "369901d122f4a6d8adec4bec409dc25e92c96ff37c26a145b681702f7971a6a1", + "line": 10, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/inventory.ini", + "similarity_id": "33738570f6448f344b956896d42f75b6216ace7814a46c8b6002d483c70c25b8", + "line": 19, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/inventory.ini", + "similarity_id": "97e89fa95681e604d1c4504858554eef5df45cee2055fe4505a1e6c1baf30aa8", + "line": 18, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/inventory.ini", + "similarity_id": "21ca21d14467d66a7b83bdc36e6292b114d13bde377021c0ca107078a8afa0d4", + "line": 5, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/configure.yml", + "similarity_id": "2a8df5710fcdceeff811ec6532d6bcba17d9b6c603d0fecdfecc87f3b128aac5", + "line": 16, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/deploy.yml", + "similarity_id": "d6fbd659326192fbd0bfcc010d5fc97f5db716570596efd8b730ce20e6606683", + "line": 12, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "Passwords And Secrets - Generic Secret", + "query_id": "3e2d3b2f-c22a-4df1-9cc6-a7a0aebb0c99", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/inventory.ini", + "similarity_id": "403da6866e75f1a26d35f59ab3d1763e8971d9febb1392b355bbbc357b156690", + "line": 20, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "Passwords And Secrets - Password in URL", + "query_id": "c4d3b58a-e6d4-450f-9340-04f1e702eaae", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/deploy.yml", + "similarity_id": "895e407b4fb7371dee128429969964f297da99fed47494dbb55bb0627fb8b7ff", + "line": 16, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + }, + { + "file_name": "../../src/deploy.yml", + "similarity_id": "8c1dd50d50bac18f0c169f282f8af8782dfbc8f0c3271edb415981a73d6e5af5", + "line": 72, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "Unpinned Package Version", + "query_id": "c05e2c20-0a2c-4686-b1f8-5f0a5612d4e8", + "query_url": "https://ansible.readthedocs.io/projects/lint/rules/package-latest/", + "severity": "LOW", + "platform": "Ansible", + "cwe": "706", + "risk_score": "4.1", + "cloud_provider": "COMMON", + "category": "Supply-Chain", + "experimental": false, + "description": "Setting state to latest performs an update and installs additional packages possibly resulting in performance degradation or loss of service", + "description_id": "43e877b3", + "files": [ + { + "file_name": "../../src/deploy.yml", + "similarity_id": "314c76114114e1e23377a262e72590a75327039d9d6137b44fdb17922fe5f990", + "line": 99, + "resource_type": "apt", + "resource_name": "Install application", + "issue_type": "IncorrectValue", + "search_key": "name={{Install application}}.{{apt}}.state", + "search_line": -1, + "search_value": "", + "expected_value": "State's task when installing a package should not be defined as 'latest' or should have set 'update_only' to 'true'", + "actual_value": "State's task is set to 'latest'" + } + ] + } + ] +} diff --git a/labs/lab6/analysis/kics-pulumi-report.html b/labs/lab6/analysis/kics-pulumi-report.html new file mode 100755 index 00000000..d837358f --- /dev/null +++ b/labs/lab6/analysis/kics-pulumi-report.html @@ -0,0 +1,50 @@ +KICS Scan ResultCheckmarx logo
KICS REPORT03/17/2026 08:13KICS.IO
KICS v2.1.20 +Scanned paths: /src +Platforms: Pulumi, CommonStart time: 08:13:57, Mar 17 2026 +End time: 08:13:58, Mar 17 2026

Vulnerabilities:

1 +CRITICAL
2 +HIGH
1 +MEDIUM
0 +LOW
2 +INFO
6 +TOTAL

RDS DB Instance Publicly Accessible

Platform: Pulumi +CWE: 284 +Risk Score: 8.7 +Category: Insecure Configurations
RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false.https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance/#publiclyaccessible_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 104
Expected: 'resources.unencryptedDb.properties.publiclyAccessible' should be set to 'false' +Found: 'resources.unencryptedDb.properties.publiclyAccessible' is set to 'true'
103 storageEncrypted: false # SECURITY ISSUE #7 - No encryption!
104 publiclyAccessible: true # SECURITY ISSUE #8 - Public access!
105 skipFinalSnapshot: true

DynamoDB Table Not Encrypted

Platform: Pulumi +CWE: 311 +Risk Score: 7.1 +Category: Encryption
AWS DynamoDB Tables should have serverSideEncryption enabledhttps://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#serversideencryption_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 205
Expected: Attribute 'serverSideEncryption' should be defined +Found: Attribute 'serverSideEncryption' is not defined
204 type: aws:dynamodb:Table
205 properties:
206 name: my-table-pulumi-yaml

Passwords And Secrets - Generic Password

Platform: Common +CWE: 798 +Risk Score: 7.8 +Category: Secret Management
Query to find passwords and secrets in infrastructure code.https://docs.kics.io/latest/secrets/
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 16
Expected: Hardcoded secret key should not appear in source +Found: Hardcoded secret key appears in source
15 # SECURITY ISSUE #1 - Hardcoded database password
16 dbPassword: <SECRET-MASKED-ON-PURPOSE>
17

EC2 Instance Monitoring Disabled

Platform: Pulumi +CWE: 778 +Risk Score: 5.1 +Category: Observability
EC2 Instance should have detailed monitoring enabled. With detailed monitoring enabled data is available in 1-minute periodshttps://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#monitoring_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 157
Expected: Attribute 'monitoring' should be defined and set to true +Found: Attribute 'monitoring' is not defined
156 type: aws:ec2:Instance
157 properties:
158 ami: ami-0c55b159cbfafe1f0

DynamoDB Table Point In Time Recovery Disabled

Platform: Pulumi +CWE: 459 +Risk Score: 0.0 +Category: Best Practices
It's considered a best practice to have point in time recovery enabled for DynamoDB Tablehttps://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#pointintimerecovery_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 213
Expected: Attribute 'enabled' in 'pointInTimeRecovery' should be set to true +Found: Attribute 'enabled' in 'pointInTimeRecovery' is set to false
212 pointInTimeRecovery:
213 enabled: false # SECURITY ISSUE #18 - No PITR
214 tags:

EC2 Not EBS Optimized

Platform: Pulumi +CWE: 459 +Risk Score: 0.0 +Category: Best Practices
It's considered a best practice for an EC2 instance to use an EBS optimized instance. This provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I/O and other traffic from your instancehttps://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#ebsoptimized_yaml
Results (1)
File: ../../src/Pulumi-vulnerable.yaml +Line 157
Expected: Attribute 'ebsOptimized' should be defined and set to true +Found: Attribute 'ebsOptimized' is not defined
156 type: aws:ec2:Instance
157 properties:
158 ami: ami-0c55b159cbfafe1f0
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love:
The KICS project is powered by Checkmarx, global leader of Application Security Testing
\ No newline at end of file diff --git a/labs/lab6/analysis/kics-pulumi-report.txt b/labs/lab6/analysis/kics-pulumi-report.txt new file mode 100644 index 00000000..359391d6 --- /dev/null +++ b/labs/lab6/analysis/kics-pulumi-report.txt @@ -0,0 +1,51 @@ + + + + MLLLLLM MLLLLLLLLL LLLLLLL KLLLLLLLLLLLLLLLL LLLLLLLLLLLLLLLLLLLLLLL + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMML KLMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM MMMMMMMMMML MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LMMMMMMMMML MMMMMMMK LMMMMMMMMMLLMLLLLLLLLLLLLLL LMMMMMMMLLLLLLLLLLLLLLLLLLLLM + MMMMMMM MMMMMMMMMLM MMMMMMMK LMMMMMMMM LMMMMMML + MMMMMMMLMMMMMMMML MMMMMMMK MMMMMMML LMMMMMMMMLLLLLLLLLLLLLMLL + MMMMMMMMMMMMMMMM MMMMMMMK MMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMMMMMMMMMMMMM MMMMMMMK MMMMMMM LMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM KLMMMMMMMMML MMMMMMMK LMMMMMMM MMMMMMMML + MMMMMMM LMMMMMMMMMM MMMMMMMK LMMMMMMMMLL MMMMMMML + MMMMMMM LMMMMMMMMMLL MMMMMMMK LMMMMMMMMMMMMMMMMMMMMMMMMML LLLLLLLLLLLLLLLLLLLLMMMMMMMMMM + MMMMMMM MMMMMMMMMMML MMMMMMMK MMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM + MMMMMMM LLMMMMMMMMML MMMMMMMK LLMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMML + MMMMMMM MMMMMMMMMML MMMMMMMK KLMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMLK + + + + +Scanning with Keeping Infrastructure as Code Secure v2.1.20 + + + Preparing Scan Assets: \ Preparing Scan Assets: Done + + + + +EC2 Not EBS Optimized, Severity: INFO, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:157 +DynamoDB Table Point In Time Recovery Disabled, Severity: INFO, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:213 +EC2 Instance Monitoring Disabled, Severity: MEDIUM, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:157 +Passwords And Secrets - Generic Password, Severity: HIGH, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:16 +DynamoDB Table Not Encrypted, Severity: HIGH, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:205 +RDS DB Instance Publicly Accessible, Severity: CRITICAL, Results: 1 + [1]: ../../src/Pulumi-vulnerable.yaml:104 + +Results Summary: +CRITICAL: 1 +HIGH: 2 +MEDIUM: 1 +LOW: 0 +INFO: 2 +TOTAL: 6 + diff --git a/labs/lab6/analysis/kics-pulumi-results.json b/labs/lab6/analysis/kics-pulumi-results.json new file mode 100755 index 00000000..17844613 --- /dev/null +++ b/labs/lab6/analysis/kics-pulumi-results.json @@ -0,0 +1,202 @@ +{ + "kics_version": "v2.1.20", + "files_scanned": 1, + "lines_scanned": 280, + "files_parsed": 1, + "lines_parsed": 261, + "lines_ignored": 19, + "files_failed_to_scan": 0, + "queries_total": 21, + "queries_failed_to_execute": 0, + "queries_failed_to_compute_similarity_id": 0, + "scan_id": "console", + "severity_counters": { + "CRITICAL": 1, + "HIGH": 2, + "INFO": 2, + "LOW": 0, + "MEDIUM": 1, + "TRACE": 0 + }, + "total_counter": 6, + "total_bom_resources": 0, + "start": "2026-03-17T08:13:57.576073088Z", + "end": "2026-03-17T08:13:58.118782631Z", + "paths": [ + "/src" + ], + "queries": [ + { + "query_name": "RDS DB Instance Publicly Accessible", + "query_id": "647de8aa-5a42-41b5-9faf-22136f117380", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance/#publiclyaccessible_yaml", + "severity": "CRITICAL", + "platform": "Pulumi", + "cwe": "284", + "risk_score": "8.7", + "cloud_provider": "AWS", + "category": "Insecure Configurations", + "experimental": false, + "description": "RDS must not be defined with public interface, which means the attribute 'PubliclyAccessible' must be set to false.", + "description_id": "be6d13f0", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "d5a823d6c65082cd99457a40fbabdf497078bce057628d51e5ec141537ee5d53", + "line": 104, + "resource_type": "aws:rds:Instance", + "resource_name": "unencryptedDb", + "issue_type": "IncorrectValue", + "search_key": "resources[unencryptedDb].properties.publiclyAccessible", + "search_line": 104, + "search_value": "", + "expected_value": "'resources.unencryptedDb.properties.publiclyAccessible' should be set to 'false'", + "actual_value": "'resources.unencryptedDb.properties.publiclyAccessible' is set to 'true'" + } + ] + }, + { + "query_name": "DynamoDB Table Not Encrypted", + "query_id": "b6a7e0ae-aed8-4a19-a993-a95760bf8836", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#serversideencryption_yaml", + "severity": "HIGH", + "platform": "Pulumi", + "cwe": "311", + "risk_score": "7.1", + "cloud_provider": "AWS", + "category": "Encryption", + "experimental": false, + "description": "AWS DynamoDB Tables should have serverSideEncryption enabled", + "description_id": "fb6a0c51", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "15376a569938e2989eb0e9db7ff05213e04607ad547e550bbc579aaa5f64e8ce", + "line": 205, + "resource_type": "aws:dynamodb:Table", + "resource_name": "Unencrypted Table", + "issue_type": "MissingAttribute", + "search_key": "resources[unencryptedTable].properties", + "search_line": 205, + "search_value": "", + "expected_value": "Attribute 'serverSideEncryption' should be defined", + "actual_value": "Attribute 'serverSideEncryption' is not defined" + } + ] + }, + { + "query_name": "Passwords And Secrets - Generic Password", + "query_id": "487f4be7-3fd9-4506-a07a-eae252180c08", + "query_url": "https://docs.kics.io/latest/secrets/", + "severity": "HIGH", + "platform": "Common", + "cwe": "798", + "risk_score": "7.8", + "cloud_provider": "COMMON", + "category": "Secret Management", + "experimental": false, + "description": "Query to find passwords and secrets in infrastructure code.", + "description_id": "d69d8a89", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "1d73d5dae3d1a4824830f1a423473d36b79973a15ca9d23f1348c3dc8a30c7e4", + "line": 16, + "issue_type": "RedundantAttribute", + "search_key": "", + "search_line": 0, + "search_value": "", + "expected_value": "Hardcoded secret key should not appear in source", + "actual_value": "Hardcoded secret key appears in source" + } + ] + }, + { + "query_name": "EC2 Instance Monitoring Disabled", + "query_id": "daa581ef-731c-4121-832d-cf078f67759d", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#monitoring_yaml", + "severity": "MEDIUM", + "platform": "Pulumi", + "cwe": "778", + "risk_score": "5.1", + "cloud_provider": "AWS", + "category": "Observability", + "experimental": false, + "description": "EC2 Instance should have detailed monitoring enabled. With detailed monitoring enabled data is available in 1-minute periods", + "description_id": "7f96d3ac", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "4d692568cdae89e9d5e0ebef040401e6b922b9ac9a51a09554ba9629b730ad7c", + "line": 157, + "resource_type": "aws:ec2:Instance", + "resource_name": "Unencrypted Instance", + "issue_type": "MissingAttribute", + "search_key": "resources[unencryptedInstance].properties", + "search_line": 157, + "search_value": "", + "expected_value": "Attribute 'monitoring' should be defined and set to true", + "actual_value": "Attribute 'monitoring' is not defined" + } + ] + }, + { + "query_name": "DynamoDB Table Point In Time Recovery Disabled", + "query_id": "327b0729-4c5c-4c44-8b5c-e476cd9c7290", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/dynamodb/table/#pointintimerecovery_yaml", + "severity": "INFO", + "platform": "Pulumi", + "cwe": "459", + "risk_score": "0.0", + "cloud_provider": "AWS", + "category": "Best Practices", + "experimental": false, + "description": "It's considered a best practice to have point in time recovery enabled for DynamoDB Table", + "description_id": "6ff56c6e", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "7b5c72142600d0995c06ae3634f4776b5565be2c0323d509b9b51e9d915b03e8", + "line": 213, + "resource_type": "aws:dynamodb:Table", + "resource_name": "Unencrypted Table", + "issue_type": "IncorrectValue", + "search_key": "resources[unencryptedTable].properties.pointInTimeRecovery.enabled", + "search_line": 213, + "search_value": "", + "expected_value": "Attribute 'enabled' in 'pointInTimeRecovery' should be set to true", + "actual_value": "Attribute 'enabled' in 'pointInTimeRecovery' is set to false" + } + ] + }, + { + "query_name": "EC2 Not EBS Optimized", + "query_id": "d991e4ae-42ab-429b-ab43-d5e5fa9ca633", + "query_url": "https://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/#ebsoptimized_yaml", + "severity": "INFO", + "platform": "Pulumi", + "cwe": "459", + "risk_score": "0.0", + "cloud_provider": "AWS", + "category": "Best Practices", + "experimental": false, + "description": "It's considered a best practice for an EC2 instance to use an EBS optimized instance. This provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I/O and other traffic from your instance", + "description_id": "81a001dd", + "files": [ + { + "file_name": "../../src/Pulumi-vulnerable.yaml", + "similarity_id": "9d46c3011c910cf43e7d99575a291f05b1b4f701f62e99c132837e16f7ee27a4", + "line": 157, + "resource_type": "aws:ec2:Instance", + "resource_name": "unencryptedInstance", + "issue_type": "MissingAttribute", + "search_key": "resources[unencryptedInstance].properties", + "search_line": 157, + "search_value": "", + "expected_value": "Attribute 'ebsOptimized' should be defined and set to true", + "actual_value": "Attribute 'ebsOptimized' is not defined" + } + ] + } + ] +} diff --git a/labs/lab6/analysis/pulumi-analysis.txt b/labs/lab6/analysis/pulumi-analysis.txt new file mode 100644 index 00000000..b85b910d --- /dev/null +++ b/labs/lab6/analysis/pulumi-analysis.txt @@ -0,0 +1,6 @@ +=== Pulumi Security Analysis (KICS) === +KICS Pulumi findings: 6 + CRITICAL severity: 1 + HIGH severity: 2 + MEDIUM severity: 1 + LOW severity: 0 diff --git a/labs/lab6/analysis/terraform-comparison.txt b/labs/lab6/analysis/terraform-comparison.txt new file mode 100644 index 00000000..7d2f4695 --- /dev/null +++ b/labs/lab6/analysis/terraform-comparison.txt @@ -0,0 +1,4 @@ +=== Terraform Security Analysis === +tfsec findings: 53 +Checkov findings: 78 +Terrascan findings: 22 diff --git a/labs/lab6/analysis/terrascan-report.txt b/labs/lab6/analysis/terrascan-report.txt new file mode 100644 index 00000000..2ba05453 --- /dev/null +++ b/labs/lab6/analysis/terrascan-report.txt @@ -0,0 +1,216 @@ + + + +Violation Details - + + Description : Ensure that your RDS database has IAM Authentication enabled. + File : database.tf + Module Name : root + Plan Root : ./ + Line : 5 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : Ensure that your RDS database has IAM Authentication enabled. + File : database.tf + Module Name : root + Plan Root : ./ + Line : 40 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : Security Groups - Unrestricted Specific Ports - remote desktop port (TCP,3389) + File : security_groups.tf + Module Name : root + Plan Root : ./ + Line : 31 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure CloudWatch logging is enabled for AWS DB instances + File : database.tf + Module Name : root + Plan Root : ./ + Line : 5 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : Ensure CloudWatch logging is enabled for AWS DB instances + File : database.tf + Module Name : root + Plan Root : ./ + Line : 40 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : Ensure no security groups is wide open to public, that is, allows traffic from 0.0.0.0/0 to ALL ports and protocols + File : security_groups.tf + Module Name : root + Plan Root : ./ + Line : 5 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure S3 buckets do not have, a both public ACL on the bucket and a public access block. + File : main.tf + Module Name : root + Plan Root : ./ + Line : 13 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure that there are no exposed Amazon IAM access keys in order to protect your AWS resources against unapproved access + File : iam.tf + Module Name : root + Plan Root : ./ + Line : 88 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : Security Groups - Unrestricted Specific Ports - (SSH,22) + File : security_groups.tf + Module Name : root + Plan Root : ./ + Line : 31 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure that your RDS database instances encrypt the underlying storage. Encrypted RDS instances use the industry standard AES-256 encryption algorithm to encrypt data on the server that hosts RDS DB instances. After data is encrypted, RDS handles authentication of access and description of data transparently with minimal impact on performance. + File : database.tf + Module Name : root + Plan Root : ./ + Line : 5 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure DynamoDb is encrypted at rest + File : database.tf + Module Name : root + Plan Root : ./ + Line : 72 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : RDS Instance publicly_accessible flag is true + File : database.tf + Module Name : root + Plan Root : ./ + Line : 5 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure automated backups are enabled for AWS RDS instances + File : database.tf + Module Name : root + Plan Root : ./ + Line : 5 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure automated backups are enabled for AWS RDS instances + File : database.tf + Module Name : root + Plan Root : ./ + Line : 40 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : RDS Instance Auto Minor Version Upgrade flag disabled + File : database.tf + Module Name : root + Plan Root : ./ + Line : 40 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Misconfigured S3 buckets can leak private information to the entire internet or allow unauthorized data tampering / deletion + File : main.tf + Module Name : root + Plan Root : ./ + Line : 13 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Security Groups - Unrestricted Specific Ports - MySQL (TCP,3306) + File : security_groups.tf + Module Name : root + Plan Root : ./ + Line : 65 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Security Groups - Unrestricted Specific Ports - Postgres SQL (TCP,5432) + File : security_groups.tf + Module Name : root + Plan Root : ./ + Line : 65 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Ensure IAM policies are attached only to groups or roles + File : iam.tf + Module Name : root + Plan Root : ./ + Line : 67 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : Ensure Point In Time Recovery is enabled for DynamoDB Tables + File : database.tf + Module Name : root + Plan Root : ./ + Line : 72 + Severity : MEDIUM + + ----------------------------------------------------------------------- + + Description : Enabling S3 versioning will enable easy recovery from both unintended user actions, like deletes and overwrites + File : main.tf + Module Name : root + Plan Root : ./ + Line : 13 + Severity : HIGH + + ----------------------------------------------------------------------- + + Description : Enabling S3 versioning will enable easy recovery from both unintended user actions, like deletes and overwrites + File : main.tf + Module Name : root + Plan Root : ./ + Line : 24 + Severity : HIGH + + ----------------------------------------------------------------------- + + +Scan Summary - + + File/Folder : /iac + IaC Type : terraform + Scanned At : 2026-03-17 08:13:39.284487952 +0000 UTC + Policies Validated : 167 + Violated Policies : 22 + Low : 0 + Medium : 8 + High : 14 + + diff --git a/labs/lab6/analysis/terrascan-results.json b/labs/lab6/analysis/terrascan-results.json new file mode 100644 index 00000000..673c72d7 --- /dev/null +++ b/labs/lab6/analysis/terrascan-results.json @@ -0,0 +1,303 @@ +{ + "results": { + "violations": [ + { + "rule_name": "port22OpenToInternet", + "description": "Security Groups - Unrestricted Specific Ports - (SSH,22)", + "rule_id": "AC_AWS_0227", + "severity": "HIGH", + "category": "Infrastructure Security", + "resource_name": "ssh_open", + "resource_type": "aws_security_group", + "module_name": "root", + "file": "security_groups.tf", + "plan_root": "./", + "line": 31 + }, + { + "rule_name": "allUsersReadAccess", + "description": "Misconfigured S3 buckets can leak private information to the entire internet or allow unauthorized data tampering / deletion", + "rule_id": "AC_AWS_0210", + "severity": "HIGH", + "category": "Identity and Access Management", + "resource_name": "public_data", + "resource_type": "aws_s3_bucket", + "module_name": "root", + "file": "main.tf", + "plan_root": "./", + "line": 13 + }, + { + "rule_name": "port5432AlbNetworkPortSecurity", + "description": "Security Groups - Unrestricted Specific Ports - Postgres SQL (TCP,5432)", + "rule_id": "AC_AWS_0262", + "severity": "HIGH", + "category": "Infrastructure Security", + "resource_name": "database_exposed", + "resource_type": "aws_security_group", + "module_name": "root", + "file": "security_groups.tf", + "plan_root": "./", + "line": 65 + }, + { + "rule_name": "rdsAutoMinorVersionUpgradeEnabled", + "description": "RDS Instance Auto Minor Version Upgrade flag disabled", + "rule_id": "AC_AWS_0056", + "severity": "HIGH", + "category": "Data Protection", + "resource_name": "weak_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 40 + }, + { + "rule_name": "rdsHasStorageEncrypted", + "description": "Ensure that your RDS database instances encrypt the underlying storage. Encrypted RDS instances use the industry standard AES-256 encryption algorithm to encrypt data on the server that hosts RDS DB instances. After data is encrypted, RDS handles authentication of access and description of data transparently with minimal impact on performance.", + "rule_id": "AC_AWS_0058", + "severity": "HIGH", + "category": "Data Protection", + "resource_name": "unencrypted_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 5 + }, + { + "rule_name": "s3Versioning", + "description": "Enabling S3 versioning will enable easy recovery from both unintended user actions, like deletes and overwrites", + "rule_id": "AC_AWS_0214", + "severity": "HIGH", + "category": "Resilience", + "resource_name": "public_data", + "resource_type": "aws_s3_bucket", + "module_name": "root", + "file": "main.tf", + "plan_root": "./", + "line": 13 + }, + { + "rule_name": "s3Versioning", + "description": "Enabling S3 versioning will enable easy recovery from both unintended user actions, like deletes and overwrites", + "rule_id": "AC_AWS_0214", + "severity": "HIGH", + "category": "Resilience", + "resource_name": "unencrypted_data", + "resource_type": "aws_s3_bucket", + "module_name": "root", + "file": "main.tf", + "plan_root": "./", + "line": 24 + }, + { + "rule_name": "port3306AlbNetworkPortSecurity", + "description": "Security Groups - Unrestricted Specific Ports - MySQL (TCP,3306)", + "rule_id": "AC_AWS_0253", + "severity": "HIGH", + "category": "Infrastructure Security", + "resource_name": "database_exposed", + "resource_type": "aws_security_group", + "module_name": "root", + "file": "security_groups.tf", + "plan_root": "./", + "line": 65 + }, + { + "rule_name": "dynamoDbEncrypted", + "description": "Ensure DynamoDb is encrypted at rest", + "rule_id": "AC_AWS_0457", + "severity": "MEDIUM", + "category": "Data Protection", + "resource_name": "unencrypted_table", + "resource_type": "aws_dynamodb_table", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 72 + }, + { + "rule_name": "rdsIamAuthEnabled", + "description": "Ensure that your RDS database has IAM Authentication enabled.", + "rule_id": "AC_AWS_0053", + "severity": "MEDIUM", + "category": "Data Protection", + "resource_name": "unencrypted_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 5 + }, + { + "rule_name": "rdsIamAuthEnabled", + "description": "Ensure that your RDS database has IAM Authentication enabled.", + "rule_id": "AC_AWS_0053", + "severity": "MEDIUM", + "category": "Data Protection", + "resource_name": "weak_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 40 + }, + { + "rule_name": "s3PublicAclNoAccessBlock", + "description": "Ensure S3 buckets do not have, a both public ACL on the bucket and a public access block.", + "rule_id": "AC_AWS_0496", + "severity": "HIGH", + "category": "Identity and Access Management", + "resource_name": "public_data", + "resource_type": "aws_s3_bucket", + "module_name": "root", + "file": "main.tf", + "plan_root": "./", + "line": 13 + }, + { + "rule_name": "dynamoderecovery_enabled", + "description": "Ensure Point In Time Recovery is enabled for DynamoDB Tables", + "rule_id": "AC_AWS_0458", + "severity": "MEDIUM", + "category": "Resilience", + "resource_name": "unencrypted_table", + "resource_type": "aws_dynamodb_table", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 72 + }, + { + "rule_name": "port3389OpenToInternet", + "description": "Security Groups - Unrestricted Specific Ports - remote desktop port (TCP,3389)", + "rule_id": "AC_AWS_0230", + "severity": "HIGH", + "category": "Infrastructure Security", + "resource_name": "ssh_open", + "resource_type": "aws_security_group", + "module_name": "root", + "file": "security_groups.tf", + "plan_root": "./", + "line": 31 + }, + { + "rule_name": "programmaticAccessCreation", + "description": "Ensure that there are no exposed Amazon IAM access keys in order to protect your AWS resources against unapproved access", + "rule_id": "AC_AWS_0133", + "severity": "MEDIUM", + "category": "Identity and Access Management", + "resource_name": "service_key", + "resource_type": "aws_iam_access_key", + "module_name": "root", + "file": "iam.tf", + "plan_root": "./", + "line": 88 + }, + { + "rule_name": "rdsPubliclyAccessible", + "description": "RDS Instance publicly_accessible flag is true", + "rule_id": "AC_AWS_0054", + "severity": "HIGH", + "category": "Infrastructure Security", + "resource_name": "unencrypted_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 5 + }, + { + "rule_name": "iamUserInlinePolicy", + "description": "Ensure IAM policies are attached only to groups or roles", + "rule_id": "AC_AWS_0475", + "severity": "MEDIUM", + "category": "Identity and Access Management", + "resource_name": "service_policy", + "resource_type": "aws_iam_user_policy", + "module_name": "root", + "file": "iam.tf", + "plan_root": "./", + "line": 67 + }, + { + "rule_name": "rdsBackupDisabled", + "description": "Ensure automated backups are enabled for AWS RDS instances", + "rule_id": "AC_AWS_0052", + "severity": "HIGH", + "category": "Data Protection", + "resource_name": "unencrypted_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 5 + }, + { + "rule_name": "rdsBackupDisabled", + "description": "Ensure automated backups are enabled for AWS RDS instances", + "rule_id": "AC_AWS_0052", + "severity": "HIGH", + "category": "Data Protection", + "resource_name": "weak_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 40 + }, + { + "rule_name": "rdsLogExportDisabled", + "description": "Ensure CloudWatch logging is enabled for AWS DB instances", + "rule_id": "AC_AWS_0454", + "severity": "MEDIUM", + "category": "Logging and Monitoring", + "resource_name": "unencrypted_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 5 + }, + { + "rule_name": "rdsLogExportDisabled", + "description": "Ensure CloudWatch logging is enabled for AWS DB instances", + "rule_id": "AC_AWS_0454", + "severity": "MEDIUM", + "category": "Logging and Monitoring", + "resource_name": "weak_db", + "resource_type": "aws_db_instance", + "module_name": "root", + "file": "database.tf", + "plan_root": "./", + "line": 40 + }, + { + "rule_name": "portWideOpenToPublic", + "description": "Ensure no security groups is wide open to public, that is, allows traffic from 0.0.0.0/0 to ALL ports and protocols", + "rule_id": "AC_AWS_0275", + "severity": "HIGH", + "category": "Infrastructure Security", + "resource_name": "allow_all", + "resource_type": "aws_security_group", + "module_name": "root", + "file": "security_groups.tf", + "plan_root": "./", + "line": 5 + } + ], + "skipped_violations": null, + "scan_summary": { + "file/folder": "/iac", + "iac_type": "terraform", + "scanned_at": "2026-03-17 08:13:22.411850514 +0000 UTC", + "policies_validated": 167, + "violated_policies": 22, + "low": 0, + "medium": 8, + "high": 14 + } + } +} diff --git a/labs/lab6/analysis/tfsec-report.txt b/labs/lab6/analysis/tfsec-report.txt new file mode 100644 index 00000000..88222cbd --- /dev/null +++ b/labs/lab6/analysis/tfsec-report.txt @@ -0,0 +1,1102 @@ + +Result #1 CRITICAL Instance is exposed publicly.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:17 +──────────────────────────────────────────────────────────────────────────────── + 5  resource "aws_db_instance" "unencrypted_db" { + .  + 17 [ publicly_accessible = true # SECURITY ISSUE #10 - Public access! (true) + ..  + 37  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-rds-no-public-db-access +  Impact The database instance is publicly accessible + Resolution Set the database to not be publicly accessible + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/no-public-db-access/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance +──────────────────────────────────────────────────────────────────────────────── + + +Result #2 CRITICAL Security group rule allows ingress from public internet.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:15 +──────────────────────────────────────────────────────────────────────────────── + 5  resource "aws_security_group" "allow_all" { + .  + 15 [  cidr_blocks = ["0.0.0.0/0"] # From anywhere! + ..  + 28  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-ingress-sgr +  Impact Your port exposed to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks +──────────────────────────────────────────────────────────────────────────────── + + +Result #3 CRITICAL Security group rule allows egress to multiple public internet addresses.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:22 +──────────────────────────────────────────────────────────────────────────────── + 5  resource "aws_security_group" "allow_all" { + .  + 22 [  cidr_blocks = ["0.0.0.0/0"] + ..  + 28  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-egress-sgr +  Impact Your port is egressing data to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-egress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group +──────────────────────────────────────────────────────────────────────────────── + + +Result #4 CRITICAL Security group rule allows ingress from public internet.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:41 +──────────────────────────────────────────────────────────────────────────────── + 31  resource "aws_security_group" "ssh_open" { + ..  + 41 [  cidr_blocks = ["0.0.0.0/0"] # SSH from anywhere! + ..  + 62  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-ingress-sgr +  Impact Your port exposed to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks +──────────────────────────────────────────────────────────────────────────────── + + +Result #5 CRITICAL Security group rule allows ingress from public internet.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:49 +──────────────────────────────────────────────────────────────────────────────── + 31  resource "aws_security_group" "ssh_open" { + ..  + 49 [  cidr_blocks = ["0.0.0.0/0"] # RDP from anywhere! + ..  + 62  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-ingress-sgr +  Impact Your port exposed to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks +──────────────────────────────────────────────────────────────────────────────── + + +Result #6 CRITICAL Security group rule allows egress to multiple public internet addresses.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:56 +──────────────────────────────────────────────────────────────────────────────── + 31  resource "aws_security_group" "ssh_open" { + ..  + 56 [  cidr_blocks = ["0.0.0.0/0"] + ..  + 62  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-egress-sgr +  Impact Your port is egressing data to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-egress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group +──────────────────────────────────────────────────────────────────────────────── + + +Result #7 CRITICAL Security group rule allows ingress from public internet.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:75 +──────────────────────────────────────────────────────────────────────────────── + 65  resource "aws_security_group" "database_exposed" { + ..  + 75 [  cidr_blocks = ["0.0.0.0/0"] # Database exposed! + ..  + 92  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-ingress-sgr +  Impact Your port exposed to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks +──────────────────────────────────────────────────────────────────────────────── + + +Result #8 CRITICAL Security group rule allows ingress from public internet.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:83 +──────────────────────────────────────────────────────────────────────────────── + 65  resource "aws_security_group" "database_exposed" { + ..  + 83 [  cidr_blocks = ["0.0.0.0/0"] # Database exposed! + ..  + 92  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-ingress-sgr +  Impact Your port exposed to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks +──────────────────────────────────────────────────────────────────────────────── + + +Result #9 CRITICAL Security group rule allows egress to multiple public internet addresses.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:90 +──────────────────────────────────────────────────────────────────────────────── + 65  resource "aws_security_group" "database_exposed" { + ..  + 90 [  cidr_blocks = ["0.0.0.0/0"] + ..  + 92  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-no-public-egress-sgr +  Impact Your port is egressing data to the internet + Resolution Set a more restrictive cidr range + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-egress-sgr/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group +──────────────────────────────────────────────────────────────────────────────── + + +Result #10 HIGH Instance does not have storage encryption enabled.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:15 +──────────────────────────────────────────────────────────────────────────────── + 5  resource "aws_db_instance" "unencrypted_db" { + .  + 15 [ storage_encrypted = false # No encryption! (false) + ..  + 37  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-rds-encrypt-instance-storage-data +  Impact Data can be read from RDS instances if compromised + Resolution Enable encryption for RDS instances + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/encrypt-instance-storage-data/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance +──────────────────────────────────────────────────────────────────────────────── + + +Result #11 HIGH Instance has Public Access enabled  +──────────────────────────────────────────────────────────────────────────────── + database.tf:17 +──────────────────────────────────────────────────────────────────────────────── + 17   publicly_accessible = true # SECURITY ISSUE #10 - Public access! +──────────────────────────────────────────────────────────────────────────────── + Rego Package builtin.aws.rds.aws0180 +  Rego Rule deny +──────────────────────────────────────────────────────────────────────────────── + + +Result #12 HIGH Table encryption is not enabled.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:72-92 +──────────────────────────────────────────────────────────────────────────────── + 72 ┌ resource "aws_dynamodb_table" "unencrypted_table" { + 73 │ name = "my-table" + 74 │  billing_mode = "PAY_PER_REQUEST" + 75 │  hash_key = "id" + 76 │  + 77 │ attribute { + 78 │ name = "id" + 79 │  type = "S" + 80 └  } + ..  +──────────────────────────────────────────────────────────────────────────────── +  ID aws-dynamodb-enable-at-rest-encryption +  Impact Data can be freely read if compromised + Resolution Enable encryption at rest for DAX Cluster + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/dynamodb/enable-at-rest-encryption/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dax_cluster#server_side_encryption +──────────────────────────────────────────────────────────────────────────────── + + +Result #13 HIGH IAM policy document uses sensitive action 'iam:CreatePolicy' on wildcarded resource '*'  +──────────────────────────────────────────────────────────────────────────────── + iam.tf:109 +──────────────────────────────────────────────────────────────────────────────── + 104  resource "aws_iam_policy" "privilege_escalation" { + ...  + 109 [ Version = "2012-10-17" + ...  + 125  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-iam-no-policy-wildcards +  Impact Overly permissive policies may grant access to sensitive resources + Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards. + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document +──────────────────────────────────────────────────────────────────────────────── + + +Results #14-15 HIGH IAM policy document uses wildcarded action '*' (2 similar results) +──────────────────────────────────────────────────────────────────────────────── + iam.tf:10 +──────────────────────────────────────────────────────────────────────────────── + 5  resource "aws_iam_policy" "admin_policy" { + .  + 10 [ Version = "2012-10-17" + ..  + 19  } +──────────────────────────────────────────────────────────────────────────────── + Individual Causes + - iam.tf:5-19 (aws_iam_policy.admin_policy) + - iam.tf:5-19 (aws_iam_policy.admin_policy) +──────────────────────────────────────────────────────────────────────────────── +  ID aws-iam-no-policy-wildcards +  Impact Overly permissive policies may grant access to sensitive resources + Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards. + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document +──────────────────────────────────────────────────────────────────────────────── + + +Results #16-17 HIGH IAM policy document uses sensitive action 's3:*' on wildcarded resource '*' (2 similar results) +──────────────────────────────────────────────────────────────────────────────── + iam.tf:44 +──────────────────────────────────────────────────────────────────────────────── + 39  resource "aws_iam_role_policy" "s3_full_access" { + ..  + 44 [ Version = "2012-10-17" + ..  + 55  } +──────────────────────────────────────────────────────────────────────────────── + Individual Causes + - iam.tf:39-55 (aws_iam_role_policy.s3_full_access) 2 instances +──────────────────────────────────────────────────────────────────────────────── +  ID aws-iam-no-policy-wildcards +  Impact Overly permissive policies may grant access to sensitive resources + Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards. + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document +──────────────────────────────────────────────────────────────────────────────── + + +Results #18-21 HIGH IAM policy document uses wildcarded action 'ec2:*' (4 similar results) +──────────────────────────────────────────────────────────────────────────────── + iam.tf:72 +──────────────────────────────────────────────────────────────────────────────── + 67  resource "aws_iam_user_policy" "service_policy" { + ..  + 72 [ Version = "2012-10-17" + ..  + 85  } +──────────────────────────────────────────────────────────────────────────────── + Individual Causes + - iam.tf:67-85 (aws_iam_user_policy.service_policy) + - iam.tf:67-85 (aws_iam_user_policy.service_policy) 3 instances +──────────────────────────────────────────────────────────────────────────────── +  ID aws-iam-no-policy-wildcards +  Impact Overly permissive policies may grant access to sensitive resources + Resolution Specify the exact permissions required, and to which resources they should apply instead of using wildcards. + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document +──────────────────────────────────────────────────────────────────────────────── + + +Result #22 HIGH Bucket does not have encryption enabled  +──────────────────────────────────────────────────────────────────────────────── + main.tf:13-21 +──────────────────────────────────────────────────────────────────────────────── + 13   resource "aws_s3_bucket" "public_data" { + 14   bucket = "my-public-bucket-lab6" + 15    acl = "public-read" # Public access enabled! + 16    + 17    tags = { + 18   Name = "Public Data Bucket" + 19    # Missing required tags: Environment, Owner, CostCenter + 20    } + 21   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-enable-bucket-encryption +  Impact The bucket objects could be read if compromised + Resolution Configure bucket encryption + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-encryption/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption +──────────────────────────────────────────────────────────────────────────────── + + +Result #23 HIGH Bucket does not encrypt data with a customer managed key.  +──────────────────────────────────────────────────────────────────────────────── + main.tf:13-21 +──────────────────────────────────────────────────────────────────────────────── + 13   resource "aws_s3_bucket" "public_data" { + 14   bucket = "my-public-bucket-lab6" + 15    acl = "public-read" # Public access enabled! + 16    + 17    tags = { + 18   Name = "Public Data Bucket" + 19    # Missing required tags: Environment, Owner, CostCenter + 20    } + 21   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-encryption-customer-key +  Impact Using AWS managed keys does not allow for fine grained control + Resolution Enable encryption using customer managed keys + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/encryption-customer-key/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption +──────────────────────────────────────────────────────────────────────────────── + + +Result #24 HIGH Bucket has a public ACL: 'public-read'.  +──────────────────────────────────────────────────────────────────────────────── + main.tf:15 +──────────────────────────────────────────────────────────────────────────────── + 13  resource "aws_s3_bucket" "public_data" { + 14  bucket = "my-public-bucket-lab6" + 15 [  acl = "public-read" # Public access enabled! ("public-read") + 16   + 17   tags = { + 18  Name = "Public Data Bucket" + 19   # Missing required tags: Environment, Owner, CostCenter + 20   } + 21  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-no-public-access-with-acl +  Impact Public access to the bucket can lead to data leakage + Resolution Don't use canned ACLs or switch to private acl + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/no-public-access-with-acl/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket +──────────────────────────────────────────────────────────────────────────────── + + +Result #25 HIGH No public access block so not blocking public acls  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-block-public-acls +  Impact PUT calls with public ACLs specified can make objects public + Resolution Enable blocking any PUT calls with a public ACL specified + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-acls/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_acls +──────────────────────────────────────────────────────────────────────────────── + + +Result #26 HIGH No public access block so not blocking public policies  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-block-public-policy +  Impact Users could put a policy that allows public access + Resolution Prevent policies that allow public access being PUT + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-policy/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_policy +──────────────────────────────────────────────────────────────────────────────── + + +Result #27 HIGH Bucket does not have encryption enabled  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-enable-bucket-encryption +  Impact The bucket objects could be read if compromised + Resolution Configure bucket encryption + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-encryption/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption +──────────────────────────────────────────────────────────────────────────────── + + +Result #28 HIGH No public access block so not ignoring public acls  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-ignore-public-acls +  Impact PUT calls with public ACLs specified can make objects public + Resolution Enable ignoring the application of public ACLs in PUT calls + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/ignore-public-acls/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls +──────────────────────────────────────────────────────────────────────────────── + + +Result #29 HIGH No public access block so not restricting public buckets  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-no-public-buckets +  Impact Public buckets can be accessed by anyone + Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront) + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/no-public-buckets/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡ +──────────────────────────────────────────────────────────────────────────────── + + +Result #30 HIGH Bucket does not encrypt data with a customer managed key.  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-encryption-customer-key +  Impact Using AWS managed keys does not allow for fine grained control + Resolution Enable encryption using customer managed keys + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/encryption-customer-key/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption +──────────────────────────────────────────────────────────────────────────────── + + +Result #31 HIGH Public access block does not block public ACLs  +──────────────────────────────────────────────────────────────────────────────── + main.tf:39 +──────────────────────────────────────────────────────────────────────────────── + 36  resource "aws_s3_bucket_public_access_block" "bad_config" { + 37  bucket = aws_s3_bucket.public_data.id + 38   + 39 [ block_public_acls = false # Should be true (false) + 40   block_public_policy = false # Should be true + 41   ignore_public_acls = false # Should be true + 42   restrict_public_buckets = false # Should be true + 43  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-block-public-acls +  Impact PUT calls with public ACLs specified can make objects public + Resolution Enable blocking any PUT calls with a public ACL specified + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-acls/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_acls +──────────────────────────────────────────────────────────────────────────────── + + +Result #32 HIGH Public access block does not block public policies  +──────────────────────────────────────────────────────────────────────────────── + main.tf:40 +──────────────────────────────────────────────────────────────────────────────── + 36  resource "aws_s3_bucket_public_access_block" "bad_config" { + 37  bucket = aws_s3_bucket.public_data.id + 38   + 39  block_public_acls = false # Should be true + 40 [  block_public_policy = false # Should be true (false) + 41   ignore_public_acls = false # Should be true + 42   restrict_public_buckets = false # Should be true + 43  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-block-public-policy +  Impact Users could put a policy that allows public access + Resolution Prevent policies that allow public access being PUT + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-policy/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_policy +──────────────────────────────────────────────────────────────────────────────── + + +Result #33 HIGH Public access block does not ignore public ACLs  +──────────────────────────────────────────────────────────────────────────────── + main.tf:41 +──────────────────────────────────────────────────────────────────────────────── + 36  resource "aws_s3_bucket_public_access_block" "bad_config" { + 37  bucket = aws_s3_bucket.public_data.id + 38   + 39  block_public_acls = false # Should be true + 40   block_public_policy = false # Should be true + 41 [  ignore_public_acls = false # Should be true (false) + 42   restrict_public_buckets = false # Should be true + 43  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-ignore-public-acls +  Impact PUT calls with public ACLs specified can make objects public + Resolution Enable ignoring the application of public ACLs in PUT calls + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/ignore-public-acls/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls +──────────────────────────────────────────────────────────────────────────────── + + +Result #34 HIGH Public access block does not restrict public buckets  +──────────────────────────────────────────────────────────────────────────────── + main.tf:42 +──────────────────────────────────────────────────────────────────────────────── + 36  resource "aws_s3_bucket_public_access_block" "bad_config" { + 37  bucket = aws_s3_bucket.public_data.id + 38   + 39  block_public_acls = false # Should be true + 40   block_public_policy = false # Should be true + 41   ignore_public_acls = false # Should be true + 42 [  restrict_public_buckets = false # Should be true (false) + 43  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-no-public-buckets +  Impact Public buckets can be accessed by anyone + Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront) + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/no-public-buckets/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡ +──────────────────────────────────────────────────────────────────────────────── + + +Result #35 MEDIUM Instance has very low backup retention period.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:22 +──────────────────────────────────────────────────────────────────────────────── + 5  resource "aws_db_instance" "unencrypted_db" { + .  + 22 [  backup_retention_period = 0 # SECURITY ISSUE #11 - No backups! (0) + ..  + 37  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-rds-specify-backup-retention +  Impact Potential loss of data and short opportunity for recovery + Resolution Explicitly set the retention period to greater than the default + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/specify-backup-retention/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#backup_retention_period + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#backup_retention_period +──────────────────────────────────────────────────────────────────────────────── + + +Result #36 MEDIUM Instance does not have Deletion Protection enabled  +──────────────────────────────────────────────────────────────────────────────── + database.tf:28 +──────────────────────────────────────────────────────────────────────────────── + 28    deletion_protection = false # SECURITY ISSUE #12 +──────────────────────────────────────────────────────────────────────────────── + Rego Package builtin.aws.rds.aws0177 +  Rego Rule deny +──────────────────────────────────────────────────────────────────────────────── + + +Result #37 MEDIUM Instance has very low backup retention period.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:40-69 +──────────────────────────────────────────────────────────────────────────────── + 40 ┌ resource "aws_db_instance" "weak_db" { + 41 │ identifier = "mydb-weak" + 42 │  engine = "mysql" + 43 │  engine_version = "5.7.38" # Old version with known vulnerabilities + 44 │  instance_class = "db.t3.micro" + 45 │  allocated_storage = 20 + 46 │   + 47 │ username = "root" # Using default admin username + 48 └  password = "password123" # Weak password! + ..  +──────────────────────────────────────────────────────────────────────────────── +  ID aws-rds-specify-backup-retention +  Impact Potential loss of data and short opportunity for recovery + Resolution Explicitly set the retention period to greater than the default + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/specify-backup-retention/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#backup_retention_period + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#backup_retention_period +──────────────────────────────────────────────────────────────────────────────── + + +Result #38 MEDIUM Instance does not have IAM Authentication enabled  +──────────────────────────────────────────────────────────────────────────────── + database.tf:40-69 +──────────────────────────────────────────────────────────────────────────────── + 40 ┌ resource "aws_db_instance" "weak_db" { + 41 │ identifier = "mydb-weak" + 42 │  engine = "mysql" + 43 │  engine_version = "5.7.38" # Old version with known vulnerabilities + 44 │  instance_class = "db.t3.micro" + 45 │  allocated_storage = 20 + 46 │   + 47 │ username = "root" # Using default admin username + 48 └  password = "password123" # Weak password! + ..  +──────────────────────────────────────────────────────────────────────────────── + Rego Package builtin.aws.rds.aws0176 +  Rego Rule deny +──────────────────────────────────────────────────────────────────────────────── + + +Result #39 MEDIUM Instance does not have Deletion Protection enabled  +──────────────────────────────────────────────────────────────────────────────── + database.tf:40-69 +──────────────────────────────────────────────────────────────────────────────── + 40 ┌ resource "aws_db_instance" "weak_db" { + 41 │ identifier = "mydb-weak" + 42 │  engine = "mysql" + 43 │  engine_version = "5.7.38" # Old version with known vulnerabilities + 44 │  instance_class = "db.t3.micro" + 45 │  allocated_storage = 20 + 46 │   + 47 │ username = "root" # Using default admin username + 48 └  password = "password123" # Weak password! + ..  +──────────────────────────────────────────────────────────────────────────────── + Rego Package builtin.aws.rds.aws0177 +  Rego Rule deny +──────────────────────────────────────────────────────────────────────────────── + + +Result #40 MEDIUM Instance does not have IAM Authentication enabled  +──────────────────────────────────────────────────────────────────────────────── + database.tf:5-37 +──────────────────────────────────────────────────────────────────────────────── + 5 ┌ resource "aws_db_instance" "unencrypted_db" { + 6 │ identifier = "mydb-unencrypted" + 7 │  engine = "postgres" + 8 │  engine_version = "13.7" + 9 │  instance_class = "db.t3.micro" + 10 │  allocated_storage = 20 + 11 │   + 12 │ username = "admin" + 13 └  password = "SuperSecretPassword123!" # SECURITY ISSUE #9 - Hardcoded password! + ..  +──────────────────────────────────────────────────────────────────────────────── + Rego Package builtin.aws.rds.aws0176 +  Rego Rule deny +──────────────────────────────────────────────────────────────────────────────── + + +Result #41 MEDIUM Point-in-time recovery is not enabled.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:86 +──────────────────────────────────────────────────────────────────────────────── + 72  resource "aws_dynamodb_table" "unencrypted_table" { + ..  + 86 [ enabled = false # SECURITY ISSUE #17 (false) + ..  + 92  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-dynamodb-enable-recovery +  Impact Accidental or malicious writes and deletes can't be rolled back + Resolution Enable point in time recovery + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/dynamodb/enable-recovery/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table#point_in_time_recovery +──────────────────────────────────────────────────────────────────────────────── + + +Result #42 MEDIUM Bucket does not have logging enabled  +──────────────────────────────────────────────────────────────────────────────── + main.tf:13-21 +──────────────────────────────────────────────────────────────────────────────── + 13   resource "aws_s3_bucket" "public_data" { + 14   bucket = "my-public-bucket-lab6" + 15    acl = "public-read" # Public access enabled! + 16    + 17    tags = { + 18   Name = "Public Data Bucket" + 19    # Missing required tags: Environment, Owner, CostCenter + 20    } + 21   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-enable-bucket-logging +  Impact There is no way to determine the access to this bucket + Resolution Add a logging block to the resource to enable access logging + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-logging/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket +──────────────────────────────────────────────────────────────────────────────── + + +Result #43 MEDIUM Bucket does not have versioning enabled  +──────────────────────────────────────────────────────────────────────────────── + main.tf:13-21 +──────────────────────────────────────────────────────────────────────────────── + 13   resource "aws_s3_bucket" "public_data" { + 14   bucket = "my-public-bucket-lab6" + 15    acl = "public-read" # Public access enabled! + 16    + 17    tags = { + 18   Name = "Public Data Bucket" + 19    # Missing required tags: Environment, Owner, CostCenter + 20    } + 21   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-enable-versioning +  Impact Deleted or modified data would not be recoverable + Resolution Enable versioning to protect against accidental/malicious removal or modification + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-versioning/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning +──────────────────────────────────────────────────────────────────────────────── + + +Result #44 MEDIUM Bucket does not have logging enabled  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-enable-bucket-logging +  Impact There is no way to determine the access to this bucket + Resolution Add a logging block to the resource to enable access logging + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-logging/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket +──────────────────────────────────────────────────────────────────────────────── + + +Result #45 MEDIUM Bucket does not have versioning enabled  +──────────────────────────────────────────────────────────────────────────────── + main.tf:31 +──────────────────────────────────────────────────────────────────────────────── + 24  resource "aws_s3_bucket" "unencrypted_data" { + 25  bucket = "my-unencrypted-bucket-lab6" + 26   acl = "private" + 27    + 28  # No server_side_encryption_configuration! + 29    + 30  versioning { + 31 [ enabled = false # Versioning disabled (false) + 32   } + 33  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-enable-versioning +  Impact Deleted or modified data would not be recoverable + Resolution Enable versioning to protect against accidental/malicious removal or modification + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-versioning/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning +──────────────────────────────────────────────────────────────────────────────── + + +Result #46 LOW Instance does not have performance insights enabled.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:5-37 +──────────────────────────────────────────────────────────────────────────────── + 5 ┌ resource "aws_db_instance" "unencrypted_db" { + 6 │ identifier = "mydb-unencrypted" + 7 │  engine = "postgres" + 8 │  engine_version = "13.7" + 9 │  instance_class = "db.t3.micro" + 10 │  allocated_storage = 20 + 11 │   + 12 │ username = "admin" + 13 └  password = "SuperSecretPassword123!" # SECURITY ISSUE #9 - Hardcoded password! + ..  +──────────────────────────────────────────────────────────────────────────────── +  ID aws-rds-enable-performance-insights +  Impact Without adequate monitoring, performance related issues may go unreported and potentially lead to compromise. + Resolution Enable performance insights + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-performance-insights/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_instance#performance_insights_kms_key_id + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#performance_insights_kms_key_id +──────────────────────────────────────────────────────────────────────────────── + + +Result #47 LOW Instance does not have performance insights enabled.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:62 +──────────────────────────────────────────────────────────────────────────────── + 40  resource "aws_db_instance" "weak_db" { + ..  + 62 [  performance_insights_enabled = false (false) + ..  + 69  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-rds-enable-performance-insights +  Impact Without adequate monitoring, performance related issues may go unreported and potentially lead to compromise. + Resolution Enable performance insights + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-performance-insights/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_instance#performance_insights_kms_key_id + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#performance_insights_kms_key_id +──────────────────────────────────────────────────────────────────────────────── + + +Result #48 LOW Table encryption does not use a customer-managed KMS key.  +──────────────────────────────────────────────────────────────────────────────── + database.tf:72-92 +──────────────────────────────────────────────────────────────────────────────── + 72 ┌ resource "aws_dynamodb_table" "unencrypted_table" { + 73 │ name = "my-table" + 74 │  billing_mode = "PAY_PER_REQUEST" + 75 │  hash_key = "id" + 76 │  + 77 │ attribute { + 78 │ name = "id" + 79 │  type = "S" + 80 └  } + ..  +──────────────────────────────────────────────────────────────────────────────── +  ID aws-dynamodb-table-customer-key +  Impact Using AWS managed keys does not allow for fine grained control + Resolution Enable server side encryption with a customer managed key + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/dynamodb/table-customer-key/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table#server_side_encryption +──────────────────────────────────────────────────────────────────────────────── + + +Result #49 LOW One or more policies are attached directly to a user  +──────────────────────────────────────────────────────────────────────────────── + iam.tf:58-65 +──────────────────────────────────────────────────────────────────────────────── + 58   resource "aws_iam_user" "service_account" { + 59   name = "service-account" + 60    path = "/system/" + 61    + 62   tags = { + 63   Name = "Service Account" + 64    } + 65   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-iam-no-user-attached-policies +  Impact Complex access control is difficult to manage and maintain. + Resolution Grant policies at the group level instead. + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-user-attached-policies/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user +──────────────────────────────────────────────────────────────────────────────── + + +Result #50 LOW Bucket does not have a corresponding public access block.  +──────────────────────────────────────────────────────────────────────────────── + main.tf:24-33 +──────────────────────────────────────────────────────────────────────────────── + 24   resource "aws_s3_bucket" "unencrypted_data" { + 25   bucket = "my-unencrypted-bucket-lab6" + 26    acl = "private" + 27     + 28   # No server_side_encryption_configuration! + 29     + 30   versioning { + 31   enabled = false # Versioning disabled + 32    } + 33   } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-s3-specify-public-access-block +  Impact Public access policies may be applied to sensitive data buckets + Resolution Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/specify-public-access-block/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#bucket +──────────────────────────────────────────────────────────────────────────────── + + +Result #51 LOW Security group rule does not have a description.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:18-23 +──────────────────────────────────────────────────────────────────────────────── + 5  resource "aws_security_group" "allow_all" { + .  + 18 ┌ egress { + 19 │ from_port = 0 + 20 │  to_port = 0 + 21 │  protocol = "-1" + 22 │  cidr_blocks = ["0.0.0.0/0"] + 23 └ } + ..  + 28  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-add-description-to-security-group-rule +  Impact Descriptions provide context for the firewall rule reasons + Resolution Add descriptions for all security groups rules + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/add-description-to-security-group-rule/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule +──────────────────────────────────────────────────────────────────────────────── + + +Result #52 LOW Security group rule does not have a description.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:52-57 +──────────────────────────────────────────────────────────────────────────────── + 31  resource "aws_security_group" "ssh_open" { + ..  + 52 ┌ egress { + 53 │ from_port = 0 + 54 │  to_port = 0 + 55 │  protocol = "-1" + 56 │  cidr_blocks = ["0.0.0.0/0"] + 57 └ } + ..  + 62  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-add-description-to-security-group-rule +  Impact Descriptions provide context for the firewall rule reasons + Resolution Add descriptions for all security groups rules + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/add-description-to-security-group-rule/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule +──────────────────────────────────────────────────────────────────────────────── + + +Result #53 LOW Security group rule does not have a description.  +──────────────────────────────────────────────────────────────────────────────── + security_groups.tf:86-91 +──────────────────────────────────────────────────────────────────────────────── + 65  resource "aws_security_group" "database_exposed" { + ..  + 86 ┌ egress { + 87 │ from_port = 0 + 88 │  to_port = 0 + 89 │  protocol = "-1" + 90 │  cidr_blocks = ["0.0.0.0/0"] + 91 └ } + 92  } +──────────────────────────────────────────────────────────────────────────────── +  ID aws-ec2-add-description-to-security-group-rule +  Impact Descriptions provide context for the firewall rule reasons + Resolution Add descriptions for all security groups rules + + More Information + - https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/add-description-to-security-group-rule/ + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group + - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule +──────────────────────────────────────────────────────────────────────────────── + + + timings + ────────────────────────────────────────── + disk i/o  71.261µs + parsing  1.833228ms + adaptation  703.788µs + checks  11.424308ms + total  14.032585ms + + counts + ────────────────────────────────────────── + modules downloaded  0 + modules processed  1 + blocks processed  29 + files read  5 + + results + ────────────────────────────────────────── + passed  18 + ignored  0 + critical  9 + high  25 + medium  11 + low  8 + + 18 passed, 53 potential problem(s) detected. + + \ No newline at end of file diff --git a/labs/lab6/analysis/tfsec-results.json b/labs/lab6/analysis/tfsec-results.json new file mode 100644 index 00000000..31972d4d --- /dev/null +++ b/labs/lab6/analysis/tfsec-results.json @@ -0,0 +1,1225 @@ +{ + "results": [ + { + "rule_id": "AVD-AWS-0023", + "long_id": "aws-dynamodb-enable-at-rest-encryption", + "rule_description": "DAX Cluster and tables should always encrypt data at rest", + "rule_provider": "aws", + "rule_service": "dynamodb", + "impact": "Data can be freely read if compromised", + "resolution": "Enable encryption at rest for DAX Cluster", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/dynamodb/enable-at-rest-encryption/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dax_cluster#server_side_encryption" + ], + "description": "Table encryption is not enabled.", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_dynamodb_table.unencrypted_table", + "location": { + "filename": "/src/database.tf", + "start_line": 72, + "end_line": 92 + } + }, + { + "rule_id": "AVD-AWS-0024", + "long_id": "aws-dynamodb-enable-recovery", + "rule_description": "Point in time recovery should be enabled to protect DynamoDB table", + "rule_provider": "aws", + "rule_service": "dynamodb", + "impact": "Accidental or malicious writes and deletes can't be rolled back", + "resolution": "Enable point in time recovery", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/dynamodb/enable-recovery/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table#point_in_time_recovery" + ], + "description": "Point-in-time recovery is not enabled.", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_dynamodb_table.unencrypted_table", + "location": { + "filename": "/src/database.tf", + "start_line": 86, + "end_line": 86 + } + }, + { + "rule_id": "AVD-AWS-0025", + "long_id": "aws-dynamodb-table-customer-key", + "rule_description": "DynamoDB tables should use at rest encryption with a Customer Managed Key", + "rule_provider": "aws", + "rule_service": "dynamodb", + "impact": "Using AWS managed keys does not allow for fine grained control", + "resolution": "Enable server side encryption with a customer managed key", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/dynamodb/table-customer-key/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table#server_side_encryption" + ], + "description": "Table encryption does not use a customer-managed KMS key.", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_dynamodb_table.unencrypted_table", + "location": { + "filename": "/src/database.tf", + "start_line": 72, + "end_line": 92 + } + }, + { + "rule_id": "AVD-AWS-0124", + "long_id": "aws-ec2-add-description-to-security-group-rule", + "rule_description": "Missing description for security group rule.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Descriptions provide context for the firewall rule reasons", + "resolution": "Add descriptions for all security groups rules", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/add-description-to-security-group-rule/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule" + ], + "description": "Security group rule does not have a description.", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_security_group.database_exposed", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 86, + "end_line": 91 + } + }, + { + "rule_id": "AVD-AWS-0124", + "long_id": "aws-ec2-add-description-to-security-group-rule", + "rule_description": "Missing description for security group rule.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Descriptions provide context for the firewall rule reasons", + "resolution": "Add descriptions for all security groups rules", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/add-description-to-security-group-rule/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule" + ], + "description": "Security group rule does not have a description.", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_security_group.ssh_open", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 52, + "end_line": 57 + } + }, + { + "rule_id": "AVD-AWS-0124", + "long_id": "aws-ec2-add-description-to-security-group-rule", + "rule_description": "Missing description for security group rule.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Descriptions provide context for the firewall rule reasons", + "resolution": "Add descriptions for all security groups rules", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/add-description-to-security-group-rule/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule" + ], + "description": "Security group rule does not have a description.", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_security_group.allow_all", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 18, + "end_line": 23 + } + }, + { + "rule_id": "AVD-AWS-0104", + "long_id": "aws-ec2-no-public-egress-sgr", + "rule_description": "An egress security group rule allows traffic to /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port is egressing data to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-egress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group" + ], + "description": "Security group rule allows egress to multiple public internet addresses.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.database_exposed", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 90, + "end_line": 90 + } + }, + { + "rule_id": "AVD-AWS-0104", + "long_id": "aws-ec2-no-public-egress-sgr", + "rule_description": "An egress security group rule allows traffic to /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port is egressing data to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-egress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group" + ], + "description": "Security group rule allows egress to multiple public internet addresses.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.ssh_open", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 56, + "end_line": 56 + } + }, + { + "rule_id": "AVD-AWS-0104", + "long_id": "aws-ec2-no-public-egress-sgr", + "rule_description": "An egress security group rule allows traffic to /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port is egressing data to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-egress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group" + ], + "description": "Security group rule allows egress to multiple public internet addresses.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.allow_all", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 22, + "end_line": 22 + } + }, + { + "rule_id": "AVD-AWS-0107", + "long_id": "aws-ec2-no-public-ingress-sgr", + "rule_description": "An ingress security group rule allows traffic from /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port exposed to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks" + ], + "description": "Security group rule allows ingress from public internet.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.database_exposed", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 83, + "end_line": 83 + } + }, + { + "rule_id": "AVD-AWS-0107", + "long_id": "aws-ec2-no-public-ingress-sgr", + "rule_description": "An ingress security group rule allows traffic from /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port exposed to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks" + ], + "description": "Security group rule allows ingress from public internet.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.database_exposed", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 75, + "end_line": 75 + } + }, + { + "rule_id": "AVD-AWS-0107", + "long_id": "aws-ec2-no-public-ingress-sgr", + "rule_description": "An ingress security group rule allows traffic from /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port exposed to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks" + ], + "description": "Security group rule allows ingress from public internet.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.ssh_open", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 49, + "end_line": 49 + } + }, + { + "rule_id": "AVD-AWS-0107", + "long_id": "aws-ec2-no-public-ingress-sgr", + "rule_description": "An ingress security group rule allows traffic from /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port exposed to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks" + ], + "description": "Security group rule allows ingress from public internet.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.ssh_open", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 41, + "end_line": 41 + } + }, + { + "rule_id": "AVD-AWS-0107", + "long_id": "aws-ec2-no-public-ingress-sgr", + "rule_description": "An ingress security group rule allows traffic from /0.", + "rule_provider": "aws", + "rule_service": "ec2", + "impact": "Your port exposed to the internet", + "resolution": "Set a more restrictive cidr range", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/ec2/no-public-ingress-sgr/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule#cidr_blocks" + ], + "description": "Security group rule allows ingress from public internet.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_security_group.allow_all", + "location": { + "filename": "/src/security_groups.tf", + "start_line": 15, + "end_line": 15 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses wildcarded action 'ec2:*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_user_policy.service_policy", + "location": { + "filename": "/src/iam.tf", + "start_line": 72, + "end_line": 72 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses wildcarded action 'ec2:*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_user_policy.service_policy", + "location": { + "filename": "/src/iam.tf", + "start_line": 72, + "end_line": 72 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses wildcarded action 'ec2:*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_user_policy.service_policy", + "location": { + "filename": "/src/iam.tf", + "start_line": 72, + "end_line": 72 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses sensitive action 'ec2:*' on wildcarded resource '*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_user_policy.service_policy", + "location": { + "filename": "/src/iam.tf", + "start_line": 72, + "end_line": 72 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses sensitive action 's3:*' on wildcarded resource '*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_role_policy.s3_full_access", + "location": { + "filename": "/src/iam.tf", + "start_line": 44, + "end_line": 44 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses wildcarded action 's3:*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_role_policy.s3_full_access", + "location": { + "filename": "/src/iam.tf", + "start_line": 44, + "end_line": 44 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses sensitive action 'iam:CreatePolicy' on wildcarded resource '*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_policy.privilege_escalation", + "location": { + "filename": "/src/iam.tf", + "start_line": 109, + "end_line": 109 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses wildcarded action '*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_policy.admin_policy", + "location": { + "filename": "/src/iam.tf", + "start_line": 10, + "end_line": 10 + } + }, + { + "rule_id": "AVD-AWS-0057", + "long_id": "aws-iam-no-policy-wildcards", + "rule_description": "IAM policy should avoid use of wildcards and instead apply the principle of least privilege", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Overly permissive policies may grant access to sensitive resources", + "resolution": "Specify the exact permissions required, and to which resources they should apply instead of using wildcards.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-policy-wildcards/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" + ], + "description": "IAM policy document uses sensitive action '*' on wildcarded resource '*'", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_iam_policy.admin_policy", + "location": { + "filename": "/src/iam.tf", + "start_line": 10, + "end_line": 10 + } + }, + { + "rule_id": "AVD-AWS-0143", + "long_id": "aws-iam-no-user-attached-policies", + "rule_description": "IAM policies should not be granted directly to users.", + "rule_provider": "aws", + "rule_service": "iam", + "impact": "Complex access control is difficult to manage and maintain.", + "resolution": "Grant policies at the group level instead.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/iam/no-user-attached-policies/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user" + ], + "description": "One or more policies are attached directly to a user", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_iam_user.service_account", + "location": { + "filename": "/src/iam.tf", + "start_line": 58, + "end_line": 65 + } + }, + { + "rule_id": "AVD-AWS-0177", + "long_id": "aws-rds-enable-deletion-protection", + "rule_description": "RDS Deletion Protection Disabled", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "", + "resolution": "Modify the RDS instances to enable deletion protection.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-deletion-protection/" + ], + "description": "Instance does not have Deletion Protection enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_db_instance.weak_db", + "location": { + "filename": "/src/database.tf", + "start_line": 40, + "end_line": 69 + } + }, + { + "rule_id": "AVD-AWS-0177", + "long_id": "aws-rds-enable-deletion-protection", + "rule_description": "RDS Deletion Protection Disabled", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "", + "resolution": "Modify the RDS instances to enable deletion protection.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-deletion-protection/" + ], + "description": "Instance does not have Deletion Protection enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_db_instance.unencrypted_db.deletion_protection", + "location": { + "filename": "/src/database.tf", + "start_line": 28, + "end_line": 28 + } + }, + { + "rule_id": "AVD-AWS-0176", + "long_id": "aws-rds-enable-iam-auth", + "rule_description": "RDS IAM Database Authentication Disabled", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "", + "resolution": "Modify the PostgreSQL and MySQL type RDS instances to enable IAM database authentication.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-iam-auth/" + ], + "description": "Instance does not have IAM Authentication enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_db_instance.unencrypted_db", + "location": { + "filename": "/src/database.tf", + "start_line": 5, + "end_line": 37 + } + }, + { + "rule_id": "AVD-AWS-0176", + "long_id": "aws-rds-enable-iam-auth", + "rule_description": "RDS IAM Database Authentication Disabled", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "", + "resolution": "Modify the PostgreSQL and MySQL type RDS instances to enable IAM database authentication.", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-iam-auth/" + ], + "description": "Instance does not have IAM Authentication enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_db_instance.weak_db", + "location": { + "filename": "/src/database.tf", + "start_line": 40, + "end_line": 69 + } + }, + { + "rule_id": "AVD-AWS-0133", + "long_id": "aws-rds-enable-performance-insights", + "rule_description": "Enable Performance Insights to detect potential problems", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "Without adequate monitoring, performance related issues may go unreported and potentially lead to compromise.", + "resolution": "Enable performance insights", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-performance-insights/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_instance#performance_insights_kms_key_id", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#performance_insights_kms_key_id" + ], + "description": "Instance does not have performance insights enabled.", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_db_instance.weak_db", + "location": { + "filename": "/src/database.tf", + "start_line": 62, + "end_line": 62 + } + }, + { + "rule_id": "AVD-AWS-0133", + "long_id": "aws-rds-enable-performance-insights", + "rule_description": "Enable Performance Insights to detect potential problems", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "Without adequate monitoring, performance related issues may go unreported and potentially lead to compromise.", + "resolution": "Enable performance insights", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-performance-insights/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_instance#performance_insights_kms_key_id", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#performance_insights_kms_key_id" + ], + "description": "Instance does not have performance insights enabled.", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_db_instance.unencrypted_db", + "location": { + "filename": "/src/database.tf", + "start_line": 5, + "end_line": 37 + } + }, + { + "rule_id": "AVD-AWS-0180", + "long_id": "aws-rds-enable-public-access", + "rule_description": "RDS Publicly Accessible", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "", + "resolution": "Remove the public endpoint from the RDS instance'", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/enable-public-access/" + ], + "description": "Instance has Public Access enabled", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_db_instance.unencrypted_db.publicly_accessible", + "location": { + "filename": "/src/database.tf", + "start_line": 17, + "end_line": 17 + } + }, + { + "rule_id": "AVD-AWS-0080", + "long_id": "aws-rds-encrypt-instance-storage-data", + "rule_description": "RDS encryption has not been enabled at a DB Instance level.", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "Data can be read from RDS instances if compromised", + "resolution": "Enable encryption for RDS instances", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/encrypt-instance-storage-data/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance" + ], + "description": "Instance does not have storage encryption enabled.", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_db_instance.unencrypted_db", + "location": { + "filename": "/src/database.tf", + "start_line": 15, + "end_line": 15 + } + }, + { + "rule_id": "AVD-AWS-0082", + "long_id": "aws-rds-no-public-db-access", + "rule_description": "A database resource is marked as publicly accessible.", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "The database instance is publicly accessible", + "resolution": "Set the database to not be publicly accessible", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/no-public-db-access/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance" + ], + "description": "Instance is exposed publicly.", + "severity": "CRITICAL", + "warning": false, + "status": 0, + "resource": "aws_db_instance.unencrypted_db", + "location": { + "filename": "/src/database.tf", + "start_line": 17, + "end_line": 17 + } + }, + { + "rule_id": "AVD-AWS-0077", + "long_id": "aws-rds-specify-backup-retention", + "rule_description": "RDS Cluster and RDS instance should have backup retention longer than default 1 day", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "Potential loss of data and short opportunity for recovery", + "resolution": "Explicitly set the retention period to greater than the default", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/specify-backup-retention/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#backup_retention_period", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#backup_retention_period" + ], + "description": "Instance has very low backup retention period.", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_db_instance.weak_db", + "location": { + "filename": "/src/database.tf", + "start_line": 40, + "end_line": 69 + } + }, + { + "rule_id": "AVD-AWS-0077", + "long_id": "aws-rds-specify-backup-retention", + "rule_description": "RDS Cluster and RDS instance should have backup retention longer than default 1 day", + "rule_provider": "aws", + "rule_service": "rds", + "impact": "Potential loss of data and short opportunity for recovery", + "resolution": "Explicitly set the retention period to greater than the default", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/rds/specify-backup-retention/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#backup_retention_period", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#backup_retention_period" + ], + "description": "Instance has very low backup retention period.", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_db_instance.unencrypted_db", + "location": { + "filename": "/src/database.tf", + "start_line": 22, + "end_line": 22 + } + }, + { + "rule_id": "AVD-AWS-0086", + "long_id": "aws-s3-block-public-acls", + "rule_description": "S3 Access block should block public ACL", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "PUT calls with public ACLs specified can make objects public", + "resolution": "Enable blocking any PUT calls with a public ACL specified", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-acls/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_acls" + ], + "description": "Public access block does not block public ACLs", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket_public_access_block.bad_config", + "location": { + "filename": "/src/main.tf", + "start_line": 39, + "end_line": 39 + } + }, + { + "rule_id": "AVD-AWS-0086", + "long_id": "aws-s3-block-public-acls", + "rule_description": "S3 Access block should block public ACL", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "PUT calls with public ACLs specified can make objects public", + "resolution": "Enable blocking any PUT calls with a public ACL specified", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-acls/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_acls" + ], + "description": "No public access block so not blocking public acls", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + }, + { + "rule_id": "AVD-AWS-0087", + "long_id": "aws-s3-block-public-policy", + "rule_description": "S3 Access block should block public policy", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Users could put a policy that allows public access", + "resolution": "Prevent policies that allow public access being PUT", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-policy/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_policy" + ], + "description": "Public access block does not block public policies", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket_public_access_block.bad_config", + "location": { + "filename": "/src/main.tf", + "start_line": 40, + "end_line": 40 + } + }, + { + "rule_id": "AVD-AWS-0087", + "long_id": "aws-s3-block-public-policy", + "rule_description": "S3 Access block should block public policy", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Users could put a policy that allows public access", + "resolution": "Prevent policies that allow public access being PUT", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/block-public-policy/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#block_public_policy" + ], + "description": "No public access block so not blocking public policies", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + }, + { + "rule_id": "AVD-AWS-0088", + "long_id": "aws-s3-enable-bucket-encryption", + "rule_description": "Unencrypted S3 bucket.", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "The bucket objects could be read if compromised", + "resolution": "Configure bucket encryption", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-encryption/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption" + ], + "description": "Bucket does not have encryption enabled", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + }, + { + "rule_id": "AVD-AWS-0088", + "long_id": "aws-s3-enable-bucket-encryption", + "rule_description": "Unencrypted S3 bucket.", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "The bucket objects could be read if compromised", + "resolution": "Configure bucket encryption", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-encryption/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption" + ], + "description": "Bucket does not have encryption enabled", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.public_data", + "location": { + "filename": "/src/main.tf", + "start_line": 13, + "end_line": 21 + } + }, + { + "rule_id": "AVD-AWS-0089", + "long_id": "aws-s3-enable-bucket-logging", + "rule_description": "S3 Bucket does not have logging enabled.", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "There is no way to determine the access to this bucket", + "resolution": "Add a logging block to the resource to enable access logging", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-logging/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket" + ], + "description": "Bucket does not have logging enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + }, + { + "rule_id": "AVD-AWS-0089", + "long_id": "aws-s3-enable-bucket-logging", + "rule_description": "S3 Bucket does not have logging enabled.", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "There is no way to determine the access to this bucket", + "resolution": "Add a logging block to the resource to enable access logging", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-bucket-logging/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket" + ], + "description": "Bucket does not have logging enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.public_data", + "location": { + "filename": "/src/main.tf", + "start_line": 13, + "end_line": 21 + } + }, + { + "rule_id": "AVD-AWS-0090", + "long_id": "aws-s3-enable-versioning", + "rule_description": "S3 Data should be versioned", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Deleted or modified data would not be recoverable", + "resolution": "Enable versioning to protect against accidental/malicious removal or modification", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-versioning/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning" + ], + "description": "Bucket does not have versioning enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 31, + "end_line": 31 + } + }, + { + "rule_id": "AVD-AWS-0090", + "long_id": "aws-s3-enable-versioning", + "rule_description": "S3 Data should be versioned", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Deleted or modified data would not be recoverable", + "resolution": "Enable versioning to protect against accidental/malicious removal or modification", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/enable-versioning/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning" + ], + "description": "Bucket does not have versioning enabled", + "severity": "MEDIUM", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.public_data", + "location": { + "filename": "/src/main.tf", + "start_line": 13, + "end_line": 21 + } + }, + { + "rule_id": "AVD-AWS-0132", + "long_id": "aws-s3-encryption-customer-key", + "rule_description": "S3 encryption should use Customer Managed Keys", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Using AWS managed keys does not allow for fine grained control", + "resolution": "Enable encryption using customer managed keys", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/encryption-customer-key/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption" + ], + "description": "Bucket does not encrypt data with a customer managed key.", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + }, + { + "rule_id": "AVD-AWS-0132", + "long_id": "aws-s3-encryption-customer-key", + "rule_description": "S3 encryption should use Customer Managed Keys", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Using AWS managed keys does not allow for fine grained control", + "resolution": "Enable encryption using customer managed keys", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/encryption-customer-key/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#enable-default-server-side-encryption" + ], + "description": "Bucket does not encrypt data with a customer managed key.", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.public_data", + "location": { + "filename": "/src/main.tf", + "start_line": 13, + "end_line": 21 + } + }, + { + "rule_id": "AVD-AWS-0091", + "long_id": "aws-s3-ignore-public-acls", + "rule_description": "S3 Access Block should Ignore Public Acl", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "PUT calls with public ACLs specified can make objects public", + "resolution": "Enable ignoring the application of public ACLs in PUT calls", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/ignore-public-acls/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls" + ], + "description": "Public access block does not ignore public ACLs", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket_public_access_block.bad_config", + "location": { + "filename": "/src/main.tf", + "start_line": 41, + "end_line": 41 + } + }, + { + "rule_id": "AVD-AWS-0091", + "long_id": "aws-s3-ignore-public-acls", + "rule_description": "S3 Access Block should Ignore Public Acl", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "PUT calls with public ACLs specified can make objects public", + "resolution": "Enable ignoring the application of public ACLs in PUT calls", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/ignore-public-acls/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls" + ], + "description": "No public access block so not ignoring public acls", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + }, + { + "rule_id": "AVD-AWS-0092", + "long_id": "aws-s3-no-public-access-with-acl", + "rule_description": "S3 Buckets not publicly accessible through ACL.", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Public access to the bucket can lead to data leakage", + "resolution": "Don't use canned ACLs or switch to private acl", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/no-public-access-with-acl/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket" + ], + "description": "Bucket has a public ACL: 'public-read'.", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.public_data", + "location": { + "filename": "/src/main.tf", + "start_line": 15, + "end_line": 15 + } + }, + { + "rule_id": "AVD-AWS-0093", + "long_id": "aws-s3-no-public-buckets", + "rule_description": "S3 Access block should restrict public bucket to limit access", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Public buckets can be accessed by anyone", + "resolution": "Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/no-public-buckets/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡" + ], + "description": "Public access block does not restrict public buckets", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket_public_access_block.bad_config", + "location": { + "filename": "/src/main.tf", + "start_line": 42, + "end_line": 42 + } + }, + { + "rule_id": "AVD-AWS-0093", + "long_id": "aws-s3-no-public-buckets", + "rule_description": "S3 Access block should restrict public bucket to limit access", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Public buckets can be accessed by anyone", + "resolution": "Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/no-public-buckets/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡" + ], + "description": "No public access block so not restricting public buckets", + "severity": "HIGH", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + }, + { + "rule_id": "AVD-AWS-0094", + "long_id": "aws-s3-specify-public-access-block", + "rule_description": "S3 buckets should each define an aws_s3_bucket_public_access_block", + "rule_provider": "aws", + "rule_service": "s3", + "impact": "Public access policies may be applied to sensitive data buckets", + "resolution": "Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies", + "links": [ + "https://aquasecurity.github.io/tfsec/v1.28.14/checks/aws/s3/specify-public-access-block/", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#bucket" + ], + "description": "Bucket does not have a corresponding public access block.", + "severity": "LOW", + "warning": false, + "status": 0, + "resource": "aws_s3_bucket.unencrypted_data", + "location": { + "filename": "/src/main.tf", + "start_line": 24, + "end_line": 33 + } + } + ] +} diff --git a/labs/lab6/analysis/tool-comparison.txt b/labs/lab6/analysis/tool-comparison.txt new file mode 100644 index 00000000..17b5074f --- /dev/null +++ b/labs/lab6/analysis/tool-comparison.txt @@ -0,0 +1,8 @@ +=== Comprehensive Tool Comparison === +Terraform Scanning Results: + - tfsec: 53 findings + - Checkov: 78 findings + - Terrascan: 22 findings + +Pulumi Scanning Results (KICS): 6 findings +Ansible Scanning Results (KICS): 10 findings diff --git a/labs/submission6.md b/labs/submission6.md new file mode 100644 index 00000000..ff4079ef --- /dev/null +++ b/labs/submission6.md @@ -0,0 +1,268 @@ +# Lab 6 — Infrastructure-as-Code Security: Scanning & Policy Enforcement + +**Date:** March 17, 2026 +**Branch:** `feature/lab6` + +## Task 1 — Terraform & Pulumi Security Scanning + +### Terraform Tool Comparison (tfsec vs Checkov vs Terrascan) + +Terraform target: `labs/lab6/vulnerable-iac/terraform/` + +- `tfsec`: **53** findings (`CRITICAL: 9`, `HIGH: 25`, `MEDIUM: 11`, `LOW: 8`) +- `Checkov`: **78** failed checks (`48` passed) +- `Terrascan`: **22** violated policies (`HIGH: 14`, `MEDIUM: 8`) + +Why counts differ: +- `Checkov` has broader policy breadth and emits many granular IAM/compliance checks. +- `tfsec` is Terraform-focused and produced high signal on network exposure and AWS misconfigurations. +- `Terrascan` reported fewer findings but mapped well to policy/compliance-oriented controls. + +### Pulumi Security Analysis (KICS) + +Pulumi target: `labs/lab6/vulnerable-iac/pulumi/Pulumi-vulnerable.yaml` + +- `KICS total findings`: **6** +- Severity split: `CRITICAL: 1`, `HIGH: 2`, `MEDIUM: 1`, `INFO: 2` + +Key Pulumi findings from KICS: +- `RDS DB Instance Publicly Accessible` (CRITICAL) at `Pulumi-vulnerable.yaml:104` +- `DynamoDB Table Not Encrypted` (HIGH) at `Pulumi-vulnerable.yaml:205` +- `Passwords And Secrets - Generic Password` (HIGH) at `Pulumi-vulnerable.yaml:16` +- `EC2 Instance Monitoring Disabled` (MEDIUM) at `Pulumi-vulnerable.yaml:157` + +### Terraform vs Pulumi Security Patterns (HCL vs YAML) + +Common issues detected in both: +- Public exposure (`0.0.0.0/0`, public DB access) +- Missing encryption (RDS/DynamoDB/S3 related) +- Secrets in IaC source +- Overly permissive IAM-style permissions + +Observed difference: +- Terraform scans produced much higher count density because three scanners were used with overlapping policy sets. +- Pulumi (scanned here with KICS) had lower finding count, but still identified critical cloud misconfiguration and secret-management risks. + +### KICS Pulumi Support Evaluation + +Strengths observed: +- Correct Pulumi YAML parsing and Pulumi-platform query matching. +- Useful AWS-focused Pulumi checks (RDS public access, DynamoDB encryption, monitoring). +- Practical secret-detection query surfaced hardcoded credentials. + +Limitations observed: +- In this lab run, KICS reported fewer findings than Terraform scanners on equivalent risk themes. +- Some Pulumi issues remain outside the active matched query subset, so KICS is best used with complementary controls where possible. + +### Critical Findings (at least 5) + +1. `main.tf:8-9` hardcoded AWS provider credentials (Checkov `CKV_AWS_41`). +2. `security_groups.tf:15/41/49/75/83` inbound access from `0.0.0.0/0` (tfsec `AVD-AWS-0107`). +3. `database.tf:17` publicly accessible RDS instance (tfsec `AVD-AWS-0082`, Checkov `CKV_AWS_17`). +4. `database.tf:15` disabled storage encryption for RDS (Checkov `CKV_AWS_16`). +5. `iam.tf:14-16` wildcard `Action="*"` and `Resource="*"` IAM policy (Checkov `CKV_AWS_63` / `CKV_AWS_62`). + +### Tool Strengths + +- `tfsec`: strongest fast feedback for Terraform-specific misconfiguration. +- `Checkov`: strongest policy breadth and multi-domain IaC coverage (especially IAM/compliance style checks). +- `Terrascan`: strongest compliance/policy interpretation with concise violation output. +- `KICS`: strongest unification across non-HCL IaC in this lab (Pulumi YAML + Ansible). + +## Task 2 — Ansible Security Scanning with KICS + +### Ansible Security Issues (KICS) + +Ansible target: `labs/lab6/vulnerable-iac/ansible/` + +- `KICS total findings`: **10** +- Severity split: `HIGH: 9`, `LOW: 1` + +Most significant Ansible findings: +- Secrets in inventory/playbooks (multiple `Generic Password` / `Generic Secret` findings) +- Credentials in URL (`deploy.yml:16`, `deploy.yml:72`) +- Non-deterministic package install (`state: latest`) at `deploy.yml:99` + +### Best Practice Violations and Security Impact + +1. Hardcoded secrets in files (`deploy.yml`, `configure.yml`, `inventory.ini`): secrets leak via git history, logs, backups. +2. Credentials embedded in repository URLs (`deploy.yml:72`): token/password disclosure and credential reuse risk. +3. Unpinned package versions (`deploy.yml:99`): non-reproducible deployments and supply-chain drift. + +### KICS Ansible Query Coverage + +KICS query families seen in this run: +- `Passwords And Secrets - Generic Password` (6 matches) +- `Passwords And Secrets - Generic Secret` (1 match) +- `Passwords And Secrets - Password in URL` (2 matches) +- `Unpinned Package Version` (1 match) + +Assessment: +- Very effective for secrets hygiene and credential exposure patterns. +- Basic operational hardening issues are also detected (package pinning), but secrets coverage is the standout. + +### Remediation Steps + +- Move secrets to Ansible Vault / external secret manager and remove hardcoded credentials from YAML/INI. +- Replace authenticated Git URLs with deploy keys or token injection from CI secrets. +- Pin package versions and explicitly manage upgrade windows. +- Add `no_log: true` to secret-handling tasks and avoid printing sensitive vars in task names/debug. + +## Task 3 — Comparative Tool Analysis & Security Insights + +### Tool Comparison Matrix + +| Criterion | tfsec | Checkov | Terrascan | KICS | +|---|---|---|---|---| +| **Total Findings** | 53 | 78 | 22 | 16 (Pulumi 6 + Ansible 10) | +| **Scan Speed** | Fast | Medium | Medium-Slow | Medium | +| **False Positives** | Low | Medium | Medium | Medium | +| **Report Quality** | ⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐ | ⭐⭐⭐ | +| **Ease of Use** | ⭐⭐⭐⭐ | ⭐⭐⭐ | ⭐⭐⭐ | ⭐⭐⭐ | +| **Documentation** | ⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐ | ⭐⭐⭐ | +| **Platform Support** | Terraform-focused | Multi-framework | Multi-framework | Multi-framework (incl. Pulumi/Ansible) | +| **Output Formats** | JSON, text, SARIF | JSON, CLI, SARIF, CycloneDX | JSON, YAML, XML, human | JSON, HTML, SARIF | +| **CI/CD Integration** | Easy | Easy-Medium | Medium | Easy-Medium | +| **Unique Strengths** | Fast Terraform misconfig checks | Broad policy catalog, detailed IAM checks | Compliance-oriented policy mapping | Unified Pulumi + Ansible scanning | + +### Vulnerability Category Analysis + +Method: keyword-based categorization over scanner result descriptions/check names (approximate, because categories can overlap). + +| Security Category | tfsec | Checkov | Terrascan | KICS (Pulumi) | KICS (Ansible) | Best Tool | +|---|---:|---:|---:|---:|---:|---| +| **Encryption Issues** | 7 | 4 | 2 | 1 | 0 | tfsec | +| **Network Security** | 11 | 15 | 5 | 0 | 0 | Checkov | +| **Secrets Management** | 0 | 3 | 1 | 1 | 9 | KICS (Ansible) | +| **IAM/Permissions** | 12 | 27 | 6 | 0 | 0 | Checkov | +| **Access Control** | 20 | 16 | 5 | 1 | 0 | tfsec | +| **Compliance/Best Practices** | 9 | 13 | 7 | 1 | 0 | Checkov | + +### Top 5 Critical Findings with Remediation Code Examples + +1. **Hardcoded AWS credentials** (`terraform/main.tf:8-9`) + +```hcl +# Vulnerable +provider "aws" { + region = "us-east-1" + access_key = "AKIAIOSFODNN7EXAMPLE" + secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" +} + +# Remediation +provider "aws" { + region = var.aws_region +} +# Use IAM role/OIDC/env vars, never commit static keys +``` + +2. **RDS publicly exposed and unencrypted** (`terraform/database.tf:15-17`) + +```hcl +# Vulnerable +storage_encrypted = false +publicly_accessible = true + +# Remediation +storage_encrypted = true +publicly_accessible = false +kms_key_id = aws_kms_key.db.arn +``` + +3. **Security groups open to internet** (`terraform/security_groups.tf:41`, `:49`, `:75`, `:83`) + +```hcl +# Vulnerable +cidr_blocks = ["0.0.0.0/0"] + +# Remediation +cidr_blocks = [var.allowed_admin_cidr] +# Prefer private SG-to-SG references for DB access +``` + +4. **Wildcard IAM admin policy** (`terraform/iam.tf:14-16`) + +```hcl +# Vulnerable +Action = "*" +Resource = "*" + +# Remediation +Action = [ + "s3:GetObject", + "s3:PutObject" +] +Resource = [ + "arn:aws:s3:::my-app-bucket/*" +] +``` + +5. **Ansible secret exposure in playbooks/inventory** (`ansible/deploy.yml:12`, `ansible/inventory.ini:5`) + +```yaml +# Vulnerable +vars: + db_password: "SuperSecret123!" + +# Remediation +vars: + db_password: "{{ vault_db_password }}" + +tasks: + - name: Use DB password safely + command: /usr/local/bin/configure-db + no_log: true +``` + +### Tool Selection Guide + +- Use `tfsec` for fast Terraform PR gating. +- Use `Checkov` for broad policy enforcement and deeper IAM/compliance coverage. +- Use `Terrascan` when compliance mapping is a priority. +- Use `KICS` to cover Pulumi and Ansible in one scanner family. +- Use layered scanning (`tfsec + Checkov + KICS`) to reduce blind spots. + +### Lessons Learned + +- Scanner overlap is real; the same root issue appears as multiple policy violations. +- A higher finding count does not always mean better prioritization quality. +- Secrets management and public exposure remain the highest-impact IaC risks. +- Multi-tool strategy is necessary when codebases use mixed IaC technologies. + +### CI/CD Integration Strategy + +1. `Pre-commit / PR fast stage`: run `tfsec` for immediate Terraform feedback. +2. `PR policy stage`: run `Checkov` with fail thresholds for high/critical findings. +3. `Framework parity stage`: run `KICS` on Pulumi and Ansible directories. +4. `Nightly compliance stage`: run `Terrascan` and trend violations over time. +5. Publish JSON/HTML artifacts for audit, and block merges on unresolved critical findings. + +### Justification of Final Tooling Strategy + +Chosen baseline stack: +- `tfsec` for speed and low-friction Terraform checks. +- `Checkov` for broad policy depth and strongest IAM/compliance detection in Terraform. +- `KICS` for Pulumi and Ansible coverage with one consistent workflow. +- `Terrascan` as a compliance-focused supplement. + +This combination balances speed, depth, and framework coverage while keeping CI maintainable. + +## Evidence Files + +- `labs/lab6/analysis/tfsec-results.json` +- `labs/lab6/analysis/tfsec-report.txt` +- `labs/lab6/analysis/checkov-terraform-results.json` +- `labs/lab6/analysis/checkov-terraform-report.txt` +- `labs/lab6/analysis/terrascan-results.json` +- `labs/lab6/analysis/terrascan-report.txt` +- `labs/lab6/analysis/kics-pulumi-results.json` +- `labs/lab6/analysis/kics-pulumi-report.html` +- `labs/lab6/analysis/kics-pulumi-report.txt` +- `labs/lab6/analysis/kics-ansible-results.json` +- `labs/lab6/analysis/kics-ansible-report.html` +- `labs/lab6/analysis/kics-ansible-report.txt` +- `labs/lab6/analysis/terraform-comparison.txt` +- `labs/lab6/analysis/pulumi-analysis.txt` +- `labs/lab6/analysis/ansible-analysis.txt` +- `labs/lab6/analysis/tool-comparison.txt` From aba997e2a9eceb347eb01572e92cf606e69a034c Mon Sep 17 00:00:00 2001 From: Rashid Badamshin Date: Sun, 22 Mar 2026 17:17:06 +0300 Subject: [PATCH 15/15] lab7 done --- labs/lab7/analysis/deployment-comparison.txt | 45 + .../hardening/docker-bench-results-clean.txt | 181 +++ labs/lab7/hardening/docker-bench-results.txt | 181 +++ labs/lab7/scanning/dockle-results.txt | 9 + labs/lab7/scanning/scout-cves.txt | 1041 +++++++++++++++++ labs/lab7/scanning/scout-quickview.txt | 13 + labs/lab7/scanning/snyk-results.txt | 255 ++++ labs/submission7.md | 220 ++++ 8 files changed, 1945 insertions(+) create mode 100644 labs/lab7/analysis/deployment-comparison.txt create mode 100644 labs/lab7/hardening/docker-bench-results-clean.txt create mode 100644 labs/lab7/hardening/docker-bench-results.txt create mode 100644 labs/lab7/scanning/dockle-results.txt create mode 100644 labs/lab7/scanning/scout-cves.txt create mode 100644 labs/lab7/scanning/scout-quickview.txt create mode 100644 labs/lab7/scanning/snyk-results.txt create mode 100644 labs/submission7.md diff --git a/labs/lab7/analysis/deployment-comparison.txt b/labs/lab7/analysis/deployment-comparison.txt new file mode 100644 index 00000000..dddab794 --- /dev/null +++ b/labs/lab7/analysis/deployment-comparison.txt @@ -0,0 +1,45 @@ +=== Functionality Test === +Default: HTTP 200 +Hardened: HTTP 200 +Production: HTTP 200 + +=== Resource Usage === +NAME CPU % MEM USAGE / LIMIT MEM % +juice-default 0.41% 108.4MiB / 13.34GiB 0.79% +juice-hardened 0.59% 95.78MiB / 512MiB 18.71% +juice-production 0.58% 97.82MiB / 512MiB 19.10% + +=== Security Configurations === + +Container: juice-default +CapDrop: +CapAdd: +SecurityOpt: +Memory: 0 +MemorySwap: 0 +CPUQuota: 0 +CPUPeriod: 0 +PIDs: +Restart: no:0 + +Container: juice-hardened +CapDrop: [ALL] +CapAdd: +SecurityOpt: [no-new-privileges] +Memory: 536870912 +MemorySwap: 1073741824 +CPUQuota: 0 +CPUPeriod: 0 +PIDs: +Restart: no:0 + +Container: juice-production +CapDrop: [ALL] +CapAdd: [NET_BIND_SERVICE] +SecurityOpt: [no-new-privileges] +Memory: 536870912 +MemorySwap: 536870912 +CPUQuota: 0 +CPUPeriod: 0 +PIDs: 100 +Restart: on-failure:3 diff --git a/labs/lab7/hardening/docker-bench-results-clean.txt b/labs/lab7/hardening/docker-bench-results-clean.txt new file mode 100644 index 00000000..4442d809 --- /dev/null +++ b/labs/lab7/hardening/docker-bench-results-clean.txt @@ -0,0 +1,181 @@ +# ------------------------------------------------------------------------------ +# Docker Bench for Security v1.3.4 +# +# Docker, Inc. (c) 2015- +# +# Checks for dozens of common best-practices around deploying Docker containers in production. +# Inspired by the CIS Docker Community Edition Benchmark v1.1.0. +# ------------------------------------------------------------------------------ + +Initializing Sun Mar 22 14:09:49 UTC 2026 + + +[INFO] 1 - Host Configuration +[WARN] 1.1 - Ensure a separate partition for containers has been created +[NOTE] 1.2 - Ensure the container host has been Hardened +[INFO] 1.3 - Ensure Docker is up to date +[INFO] * Using 26.1.3, verify is it up to date as deemed necessary +[INFO] * Your operating system vendor may provide support and security maintenance for Docker +[INFO] 1.4 - Ensure only trusted users are allowed to control Docker daemon +[INFO] * docker:x:126:j0cos,gitlab-runner +[WARN] 1.5 - Ensure auditing is configured for the Docker daemon +[WARN] 1.6 - Ensure auditing is configured for Docker files and directories - /var/lib/docker +[WARN] 1.7 - Ensure auditing is configured for Docker files and directories - /etc/docker +[WARN] 1.8 - Ensure auditing is configured for Docker files and directories - docker.service +[WARN] 1.9 - Ensure auditing is configured for Docker files and directories - docker.socket +[INFO] 1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker +[INFO] * File not found +[INFO] 1.11 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json +[INFO] * File not found +[INFO] 1.12 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd +[INFO] * File not found +[INFO] 1.13 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc +[INFO] * File not found + + +[INFO] 2 - Docker daemon configuration +[WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge +[PASS] 2.2 - Ensure the logging level is set to 'info' +[PASS] 2.3 - Ensure Docker is allowed to make changes to iptables +[PASS] 2.4 - Ensure insecure registries are not used +[PASS] 2.5 - Ensure aufs storage driver is not used +[INFO] 2.6 - Ensure TLS authentication for Docker daemon is configured +[INFO] * Docker daemon not listening on TCP +[INFO] 2.7 - Ensure the default ulimit is configured appropriately +[INFO] * Default ulimit doesn't appear to be set +[WARN] 2.8 - Enable user namespace support +[PASS] 2.9 - Ensure the default cgroup usage has been confirmed +[PASS] 2.10 - Ensure base device size is not changed until needed +[WARN] 2.11 - Ensure that authorization for Docker client commands is enabled +[WARN] 2.12 - Ensure centralized and remote logging is configured +[INFO] 2.13 - Ensure operations on legacy registry (v1) are Disabled (Deprecated) +[WARN] 2.14 - Ensure live restore is Enabled +[WARN] 2.15 - Ensure Userland Proxy is Disabled +[INFO] 2.16 - Ensure daemon-wide custom seccomp profile is applied, if needed +[PASS] 2.17 - Ensure experimental features are avoided in production +[WARN] 2.18 - Ensure containers are restricted from acquiring new privileges + + +[INFO] 3 - Docker daemon configuration files +[PASS] 3.1 - Ensure that docker.service file ownership is set to root:root +[PASS] 3.2 - Ensure that docker.service file permissions are set to 644 or more restrictive +[PASS] 3.3 - Ensure that docker.socket file ownership is set to root:root +[PASS] 3.4 - Ensure that docker.socket file permissions are set to 644 or more restrictive +[PASS] 3.5 - Ensure that /etc/docker directory ownership is set to root:root +[PASS] 3.6 - Ensure that /etc/docker directory permissions are set to 755 or more restrictive +[INFO] 3.7 - Ensure that registry certificate file ownership is set to root:root +[INFO] * Directory not found +[INFO] 3.8 - Ensure that registry certificate file permissions are set to 444 or more restrictive +[INFO] * Directory not found +[INFO] 3.9 - Ensure that TLS CA certificate file ownership is set to root:root +[INFO] * No TLS CA certificate found +[INFO] 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictive +[INFO] * No TLS CA certificate found +[INFO] 3.11 - Ensure that Docker server certificate file ownership is set to root:root +[INFO] * No TLS Server certificate found +[INFO] 3.12 - Ensure that Docker server certificate file permissions are set to 444 or more restrictive +[INFO] * No TLS Server certificate found +[INFO] 3.13 - Ensure that Docker server certificate key file ownership is set to root:root +[INFO] * No TLS Key found +[INFO] 3.14 - Ensure that Docker server certificate key file permissions are set to 400 +[INFO] * No TLS Key found +[PASS] 3.15 - Ensure that Docker socket file ownership is set to root:docker +[PASS] 3.16 - Ensure that Docker socket file permissions are set to 660 or more restrictive +[INFO] 3.17 - Ensure that daemon.json file ownership is set to root:root +[INFO] * File not found +[INFO] 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive +[INFO] * File not found +[INFO] 3.19 - Ensure that /etc/default/docker file ownership is set to root:root +[INFO] * File not found +[INFO] 3.20 - Ensure that /etc/default/docker file permissions are set to 644 or more restrictive +[INFO] * File not found + + +[INFO] 4 - Container Images and Build File +[INFO] 4.1 - Ensure a user for the container has been created +[INFO] * No containers running +[NOTE] 4.2 - Ensure that containers use trusted base images +[NOTE] 4.3 - Ensure unnecessary packages are not installed in the container +[NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches +[WARN] 4.5 - Ensure Content trust for Docker is Enabled +[WARN] 4.6 - Ensure HEALTHCHECK instructions have been added to the container image +[WARN] * No Healthcheck found: [snyk/snyk:docker] +[WARN] * No Healthcheck found: [docker/scout-cli:latest] +[WARN] * No Healthcheck found: [devops-info-service:lab08] +[WARN] * No Healthcheck found: [devops-info-service:lab07] +[WARN] * No Healthcheck found: [j0cos/devops-info-service:latest] +[WARN] * No Healthcheck found: [bridgecrew/checkov:latest] +[WARN] * No Healthcheck found: [projectdiscovery/nuclei:latest] +[WARN] * No Healthcheck found: [checkmarx/kics:latest] +[WARN] * No Healthcheck found: [aquasec/trivy:latest] +[WARN] * No Healthcheck found: [semgrep/semgrep:latest] +[WARN] * No Healthcheck found: [trufflesecurity/trufflehog:latest] +[WARN] * No Healthcheck found: [anchore/grype:latest] +[WARN] * No Healthcheck found: [anchore/syft:latest] +[WARN] * No Healthcheck found: [alpine:3.20] +[WARN] * No Healthcheck found: [prom/prometheus:v3.9.0] +[WARN] * No Healthcheck found: [secsi/sqlmap:latest] +[WARN] * No Healthcheck found: [grafana/grafana:12.3.1] +[WARN] * No Healthcheck found: [zricethezav/gitleaks:latest] +[WARN] * No Healthcheck found: [bkimminich/juice-shop:v19.0.0] +[WARN] * No Healthcheck found: [aquasec/tfsec:latest] +[WARN] * No Healthcheck found: [goodwithtech/dockle:latest] +[WARN] * No Healthcheck found: [tenable/terrascan:latest] +[WARN] * No Healthcheck found: [grafana/loki:3.0.0] +[WARN] * No Healthcheck found: [grafana/promtail:3.0.0] +[WARN] * No Healthcheck found: [alpine/nikto:latest] +[INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile +[INFO] * Update instruction found: [snyk/snyk:docker] +[INFO] * Update instruction found: [devops-info-service:lab08] +[INFO] * Update instruction found: [devops-info-service:lab07] +[INFO] * Update instruction found: [j0cos/devops-info-service:latest] +[INFO] * Update instruction found: [bridgecrew/checkov:latest] +[INFO] * Update instruction found: [checkmarx/kics:latest] +[INFO] * Update instruction found: [grafana/promtail:3.0.0] +[NOTE] 4.8 - Ensure setuid and setgid permissions are removed in the images +[INFO] 4.9 - Ensure COPY is used instead of ADD in Dockerfile +[INFO] * ADD in image history: [snyk/snyk:docker] +[INFO] * ADD in image history: [projectdiscovery/nuclei:latest] +[INFO] * ADD in image history: [aquasec/trivy:latest] +[INFO] * ADD in image history: [semgrep/semgrep:latest] +[INFO] * ADD in image history: [trufflesecurity/trufflehog:latest] +[INFO] * ADD in image history: [alpine:3.20] +[INFO] * ADD in image history: [secsi/sqlmap:latest] +[INFO] * ADD in image history: [grafana/grafana:12.3.1] +[INFO] * ADD in image history: [zricethezav/gitleaks:latest] +[INFO] * ADD in image history: [aquasec/tfsec:latest] +[INFO] * ADD in image history: [goodwithtech/dockle:latest] +[INFO] * ADD in image history: [grafana/loki:3.0.0] +[INFO] * ADD in image history: [grafana/promtail:3.0.0] +[INFO] * ADD in image history: [alpine/nikto:latest] +[INFO] * ADD in image history: [docker/docker-bench-security:latest] +[NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles +[NOTE] 4.11 - Ensure verified packages are only Installed + + +[INFO] 5 - Container Runtime +[INFO] * No containers running, skipping Section 5 + + +[INFO] 6 - Docker Security Operations +[INFO] 6.1 - Avoid image sprawl +[INFO] * There are currently: 29 images +[INFO] * Only 1 out of 29 are in use +[INFO] 6.2 - Avoid container sprawl +[INFO] * There are currently a total of 1 containers, with 1 of them currently running + + +[INFO] 7 - Docker Swarm Configuration +[PASS] 7.1 - Ensure swarm mode is not Enabled, if not needed +[PASS] 7.2 - Ensure the minimum number of manager nodes have been created in a swarm (Swarm mode not enabled) +[PASS] 7.3 - Ensure swarm services are binded to a specific host interface (Swarm mode not enabled) +[PASS] 7.4 - Ensure data exchanged between containers are encrypted on different nodes on the overlay network +[PASS] 7.5 - Ensure Docker's secret management commands are used for managing secrets in a Swarm cluster (Swarm mode not enabled) +[PASS] 7.6 - Ensure swarm manager is run in auto-lock mode (Swarm mode not enabled) +[PASS] 7.7 - Ensure swarm manager auto-lock key is rotated periodically (Swarm mode not enabled) +[PASS] 7.8 - Ensure node certificates are rotated as appropriate (Swarm mode not enabled) +[PASS] 7.9 - Ensure CA certificates are rotated as appropriate (Swarm mode not enabled) +[PASS] 7.10 - Ensure management plane traffic has been separated from data plane traffic (Swarm mode not enabled) + +[INFO] Checks: 74 +[INFO] Score: 10 diff --git a/labs/lab7/hardening/docker-bench-results.txt b/labs/lab7/hardening/docker-bench-results.txt new file mode 100644 index 00000000..9dfc1dd7 --- /dev/null +++ b/labs/lab7/hardening/docker-bench-results.txt @@ -0,0 +1,181 @@ +# ------------------------------------------------------------------------------ +# Docker Bench for Security v1.3.4 +# +# Docker, Inc. (c) 2015- +# +# Checks for dozens of common best-practices around deploying Docker containers in production. +# Inspired by the CIS Docker Community Edition Benchmark v1.1.0. +# ------------------------------------------------------------------------------ + +Initializing Sun Mar 22 14:09:49 UTC 2026 + + +[INFO] 1 - Host Configuration +[WARN] 1.1 - Ensure a separate partition for containers has been created +[NOTE] 1.2 - Ensure the container host has been Hardened +[INFO] 1.3 - Ensure Docker is up to date +[INFO] * Using 26.1.3, verify is it up to date as deemed necessary +[INFO] * Your operating system vendor may provide support and security maintenance for Docker +[INFO] 1.4 - Ensure only trusted users are allowed to control Docker daemon +[INFO] * docker:x:126:j0cos,gitlab-runner +[WARN] 1.5 - Ensure auditing is configured for the Docker daemon +[WARN] 1.6 - Ensure auditing is configured for Docker files and directories - /var/lib/docker +[WARN] 1.7 - Ensure auditing is configured for Docker files and directories - /etc/docker +[WARN] 1.8 - Ensure auditing is configured for Docker files and directories - docker.service +[WARN] 1.9 - Ensure auditing is configured for Docker files and directories - docker.socket +[INFO] 1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker +[INFO] * File not found +[INFO] 1.11 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json +[INFO] * File not found +[INFO] 1.12 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd +[INFO] * File not found +[INFO] 1.13 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc +[INFO] * File not found + + +[INFO] 2 - Docker daemon configuration +[WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge +[PASS] 2.2 - Ensure the logging level is set to 'info' +[PASS] 2.3 - Ensure Docker is allowed to make changes to iptables +[PASS] 2.4 - Ensure insecure registries are not used +[PASS] 2.5 - Ensure aufs storage driver is not used +[INFO] 2.6 - Ensure TLS authentication for Docker daemon is configured +[INFO] * Docker daemon not listening on TCP +[INFO] 2.7 - Ensure the default ulimit is configured appropriately +[INFO] * Default ulimit doesn't appear to be set +[WARN] 2.8 - Enable user namespace support +[PASS] 2.9 - Ensure the default cgroup usage has been confirmed +[PASS] 2.10 - Ensure base device size is not changed until needed +[WARN] 2.11 - Ensure that authorization for Docker client commands is enabled +[WARN] 2.12 - Ensure centralized and remote logging is configured +[INFO] 2.13 - Ensure operations on legacy registry (v1) are Disabled (Deprecated) +[WARN] 2.14 - Ensure live restore is Enabled +[WARN] 2.15 - Ensure Userland Proxy is Disabled +[INFO] 2.16 - Ensure daemon-wide custom seccomp profile is applied, if needed +[PASS] 2.17 - Ensure experimental features are avoided in production +[WARN] 2.18 - Ensure containers are restricted from acquiring new privileges + + +[INFO] 3 - Docker daemon configuration files +[PASS] 3.1 - Ensure that docker.service file ownership is set to root:root +[PASS] 3.2 - Ensure that docker.service file permissions are set to 644 or more restrictive +[PASS] 3.3 - Ensure that docker.socket file ownership is set to root:root +[PASS] 3.4 - Ensure that docker.socket file permissions are set to 644 or more restrictive +[PASS] 3.5 - Ensure that /etc/docker directory ownership is set to root:root +[PASS] 3.6 - Ensure that /etc/docker directory permissions are set to 755 or more restrictive +[INFO] 3.7 - Ensure that registry certificate file ownership is set to root:root +[INFO] * Directory not found +[INFO] 3.8 - Ensure that registry certificate file permissions are set to 444 or more restrictive +[INFO] * Directory not found +[INFO] 3.9 - Ensure that TLS CA certificate file ownership is set to root:root +[INFO] * No TLS CA certificate found +[INFO] 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictive +[INFO] * No TLS CA certificate found +[INFO] 3.11 - Ensure that Docker server certificate file ownership is set to root:root +[INFO] * No TLS Server certificate found +[INFO] 3.12 - Ensure that Docker server certificate file permissions are set to 444 or more restrictive +[INFO] * No TLS Server certificate found +[INFO] 3.13 - Ensure that Docker server certificate key file ownership is set to root:root +[INFO] * No TLS Key found +[INFO] 3.14 - Ensure that Docker server certificate key file permissions are set to 400 +[INFO] * No TLS Key found +[PASS] 3.15 - Ensure that Docker socket file ownership is set to root:docker +[PASS] 3.16 - Ensure that Docker socket file permissions are set to 660 or more restrictive +[INFO] 3.17 - Ensure that daemon.json file ownership is set to root:root +[INFO] * File not found +[INFO] 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive +[INFO] * File not found +[INFO] 3.19 - Ensure that /etc/default/docker file ownership is set to root:root +[INFO] * File not found +[INFO] 3.20 - Ensure that /etc/default/docker file permissions are set to 644 or more restrictive +[INFO] * File not found + + +[INFO] 4 - Container Images and Build File +[INFO] 4.1 - Ensure a user for the container has been created +[INFO] * No containers running +[NOTE] 4.2 - Ensure that containers use trusted base images +[NOTE] 4.3 - Ensure unnecessary packages are not installed in the container +[NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches +[WARN] 4.5 - Ensure Content trust for Docker is Enabled +[WARN] 4.6 - Ensure HEALTHCHECK instructions have been added to the container image +[WARN] * No Healthcheck found: [snyk/snyk:docker] +[WARN] * No Healthcheck found: [docker/scout-cli:latest] +[WARN] * No Healthcheck found: [devops-info-service:lab08] +[WARN] * No Healthcheck found: [devops-info-service:lab07] +[WARN] * No Healthcheck found: [j0cos/devops-info-service:latest] +[WARN] * No Healthcheck found: [bridgecrew/checkov:latest] +[WARN] * No Healthcheck found: [projectdiscovery/nuclei:latest] +[WARN] * No Healthcheck found: [checkmarx/kics:latest] +[WARN] * No Healthcheck found: [aquasec/trivy:latest] +[WARN] * No Healthcheck found: [semgrep/semgrep:latest] +[WARN] * No Healthcheck found: [trufflesecurity/trufflehog:latest] +[WARN] * No Healthcheck found: [anchore/grype:latest] +[WARN] * No Healthcheck found: [anchore/syft:latest] +[WARN] * No Healthcheck found: [alpine:3.20] +[WARN] * No Healthcheck found: [prom/prometheus:v3.9.0] +[WARN] * No Healthcheck found: [secsi/sqlmap:latest] +[WARN] * No Healthcheck found: [grafana/grafana:12.3.1] +[WARN] * No Healthcheck found: [zricethezav/gitleaks:latest] +[WARN] * No Healthcheck found: [bkimminich/juice-shop:v19.0.0] +[WARN] * No Healthcheck found: [aquasec/tfsec:latest] +[WARN] * No Healthcheck found: [goodwithtech/dockle:latest] +[WARN] * No Healthcheck found: [tenable/terrascan:latest] +[WARN] * No Healthcheck found: [grafana/loki:3.0.0] +[WARN] * No Healthcheck found: [grafana/promtail:3.0.0] +[WARN] * No Healthcheck found: [alpine/nikto:latest] +[INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile +[INFO] * Update instruction found: [snyk/snyk:docker] +[INFO] * Update instruction found: [devops-info-service:lab08] +[INFO] * Update instruction found: [devops-info-service:lab07] +[INFO] * Update instruction found: [j0cos/devops-info-service:latest] +[INFO] * Update instruction found: [bridgecrew/checkov:latest] +[INFO] * Update instruction found: [checkmarx/kics:latest] +[INFO] * Update instruction found: [grafana/promtail:3.0.0] +[NOTE] 4.8 - Ensure setuid and setgid permissions are removed in the images +[INFO] 4.9 - Ensure COPY is used instead of ADD in Dockerfile +[INFO] * ADD in image history: [snyk/snyk:docker] +[INFO] * ADD in image history: [projectdiscovery/nuclei:latest] +[INFO] * ADD in image history: [aquasec/trivy:latest] +[INFO] * ADD in image history: [semgrep/semgrep:latest] +[INFO] * ADD in image history: [trufflesecurity/trufflehog:latest] +[INFO] * ADD in image history: [alpine:3.20] +[INFO] * ADD in image history: [secsi/sqlmap:latest] +[INFO] * ADD in image history: [grafana/grafana:12.3.1] +[INFO] * ADD in image history: [zricethezav/gitleaks:latest] +[INFO] * ADD in image history: [aquasec/tfsec:latest] +[INFO] * ADD in image history: [goodwithtech/dockle:latest] +[INFO] * ADD in image history: [grafana/loki:3.0.0] +[INFO] * ADD in image history: [grafana/promtail:3.0.0] +[INFO] * ADD in image history: [alpine/nikto:latest] +[INFO] * ADD in image history: [docker/docker-bench-security:latest] +[NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles +[NOTE] 4.11 - Ensure verified packages are only Installed + + +[INFO] 5 - Container Runtime +[INFO] * No containers running, skipping Section 5 + + +[INFO] 6 - Docker Security Operations +[INFO] 6.1 - Avoid image sprawl +[INFO] * There are currently: 29 images +[INFO] * Only 1 out of 29 are in use +[INFO] 6.2 - Avoid container sprawl +[INFO] * There are currently a total of 1 containers, with 1 of them currently running + + +[INFO] 7 - Docker Swarm Configuration +[PASS] 7.1 - Ensure swarm mode is not Enabled, if not needed +[PASS] 7.2 - Ensure the minimum number of manager nodes have been created in a swarm (Swarm mode not enabled) +[PASS] 7.3 - Ensure swarm services are binded to a specific host interface (Swarm mode not enabled) +[PASS] 7.4 - Ensure data exchanged between containers are encrypted on different nodes on the overlay network +[PASS] 7.5 - Ensure Docker's secret management commands are used for managing secrets in a Swarm cluster (Swarm mode not enabled) +[PASS] 7.6 - Ensure swarm manager is run in auto-lock mode (Swarm mode not enabled) +[PASS] 7.7 - Ensure swarm manager auto-lock key is rotated periodically (Swarm mode not enabled) +[PASS] 7.8 - Ensure node certificates are rotated as appropriate (Swarm mode not enabled) +[PASS] 7.9 - Ensure CA certificates are rotated as appropriate (Swarm mode not enabled) +[PASS] 7.10 - Ensure management plane traffic has been separated from data plane traffic (Swarm mode not enabled) + +[INFO] Checks: 74 +[INFO] Score: 10 diff --git a/labs/lab7/scanning/dockle-results.txt b/labs/lab7/scanning/dockle-results.txt new file mode 100644 index 00000000..0da4e22e --- /dev/null +++ b/labs/lab7/scanning/dockle-results.txt @@ -0,0 +1,9 @@ +SKIP - DKL-LI-0001: Avoid empty password + * failed to detect etc/shadow,etc/master.passwd +INFO - CIS-DI-0005: Enable Content trust for Docker + * export DOCKER_CONTENT_TRUST=1 before docker pull/build +INFO - CIS-DI-0006: Add HEALTHCHECK instruction to the container image + * not found HEALTHCHECK statement +INFO - DKL-LI-0003: Only put necessary files + * unnecessary file : juice-shop/node_modules/micromatch/lib/.DS_Store + * unnecessary file : juice-shop/node_modules/extglob/lib/.DS_Store diff --git a/labs/lab7/scanning/scout-cves.txt b/labs/lab7/scanning/scout-cves.txt new file mode 100644 index 00000000..77dcfde9 --- /dev/null +++ b/labs/lab7/scanning/scout-cves.txt @@ -0,0 +1,1041 @@ + ...Storing image for indexing + ✓ Image stored for indexing + ...Indexing + ✓ Indexed 1004 packages + ✗ Detected 48 vulnerable packages with a total of 87 vulnerabilities + + +## Overview + + │ Analyzed Image +───────────────────┼────────────────────────────────────────── + Target │ bkimminich/juice-shop:v19.0.0 + digest │ 37cc73163c4c + platform │ linux/amd64 + provenance │ https://github.com/juice-shop/juice-shop + │ https://github.com/juice-shop/juice-shop/blob/36870cb + vulnerabilities │ 11C 65H 30M 5L 7? + size │ 172 MB + packages │ 1004 + + +## Packages and Vulnerabilities + + 4C 0H 1M 0L vm2 3.9.17 +pkg:npm/vm2@3.9.17 + + ✗ CRITICAL CVE-2026-22709 [Protection Mechanism Failure] + https://scout.docker.com/v/CVE-2026-22709?s=github&n=vm2&t=npm&vr=%3C%3D3.10.1 + Affected range : <=3.10.1 + Fixed version : 3.10.2 + CVSS Score : 9.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + + ✗ CRITICAL CVE-2023-37903 [Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')] + https://scout.docker.com/v/CVE-2023-37903?s=github&n=vm2&t=npm&vr=%3C%3D3.9.19 + Affected range : <=3.9.19 + Fixed version : not fixed + CVSS Score : 9.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + + ✗ CRITICAL CVE-2023-37466 [Improper Control of Generation of Code ('Code Injection')] + https://scout.docker.com/v/CVE-2023-37466?s=github&n=vm2&t=npm&vr=%3C%3D3.9.19 + Affected range : <=3.9.19 + Fixed version : 3.10.0 + CVSS Score : 9.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + + ✗ CRITICAL CVE-2023-32314 [Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')] + https://scout.docker.com/v/CVE-2023-32314?s=github&n=vm2&t=npm&vr=%3C3.9.18 + Affected range : <3.9.18 + Fixed version : 3.9.18 + CVSS Score : 9.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + + ✗ MEDIUM CVE-2023-32313 [Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')] + https://scout.docker.com/v/CVE-2023-32313?s=github&n=vm2&t=npm&vr=%3C3.9.18 + Affected range : <3.9.18 + Fixed version : 3.9.18 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + + + 1C 4H 1M 0L node 22.18.0 +pkg:generic/node@22.18.0 + + ✗ CRITICAL CVE-2025-55130 + https://scout.docker.com/v/CVE-2025-55130?s=docker&n=node&t=generic&vr=%3E%3D22.0.0%2C%3C22.22.0 + Affected range : >=22.0.0 + : <22.22.0 + Fixed version : 22.22.0 + + ✗ HIGH CVE-2026-21637 + https://scout.docker.com/v/CVE-2026-21637?s=docker&n=node&t=generic&vr=%3E%3D22.0.0%2C%3C22.22.0 + Affected range : >=22.0.0 + : <22.22.0 + Fixed version : 22.22.0 + + ✗ HIGH CVE-2025-59466 + https://scout.docker.com/v/CVE-2025-59466?s=docker&n=node&t=generic&vr=%3E%3D22.0.0%2C%3C22.22.0 + Affected range : >=22.0.0 + : <22.22.0 + Fixed version : 22.22.0 + + ✗ HIGH CVE-2025-59465 + https://scout.docker.com/v/CVE-2025-59465?s=docker&n=node&t=generic&vr=%3E%3D22.0.0%2C%3C22.22.0 + Affected range : >=22.0.0 + : <22.22.0 + Fixed version : 22.22.0 + + ✗ HIGH CVE-2025-55131 + https://scout.docker.com/v/CVE-2025-55131?s=docker&n=node&t=generic&vr=%3E%3D22.0.0%2C%3C22.22.0 + Affected range : >=22.0.0 + : <22.22.0 + Fixed version : 22.22.0 + + ✗ MEDIUM CVE-2025-55132 + https://scout.docker.com/v/CVE-2025-55132?s=docker&n=node&t=generic&vr=%3E%3D22.0.0%2C%3C22.22.0 + Affected range : >=22.0.0 + : <22.22.0 + Fixed version : 22.22.0 + + + 1C 3H 1M 0L 1? lodash 2.4.2 +pkg:npm/lodash@2.4.2 + + ✗ CRITICAL CVE-2019-10744 [Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')] + https://scout.docker.com/v/CVE-2019-10744?s=github&n=lodash&t=npm&vr=%3C4.17.12 + Affected range : <4.17.12 + Fixed version : 4.17.12 + CVSS Score : 9.1 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H + + ✗ HIGH CVE-2020-8203 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/CVE-2020-8203?s=gitlab&n=lodash&t=npm&vr=%3C4.17.20 + Affected range : <4.17.20 + Fixed version : 4.17.20 + CVSS Score : 7.4 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H + + ✗ HIGH CVE-2021-23337 [Improper Neutralization of Special Elements used in a Command ('Command Injection')] + https://scout.docker.com/v/CVE-2021-23337?s=github&n=lodash&t=npm&vr=%3C4.17.21 + Affected range : <4.17.21 + Fixed version : 4.17.21 + CVSS Score : 7.2 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H + + ✗ HIGH CVE-2018-16487 [Uncontrolled Resource Consumption] + https://scout.docker.com/v/CVE-2018-16487?s=github&n=lodash&t=npm&vr=%3C4.17.11 + Affected range : <4.17.11 + Fixed version : 4.17.11 + + ✗ MEDIUM CVE-2018-3721 [Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')] + https://scout.docker.com/v/CVE-2018-3721?s=github&n=lodash&t=npm&vr=%3C4.17.5 + Affected range : <4.17.5 + Fixed version : 4.17.5 + CVSS Score : 6.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N + + ✗ UNSPECIFIED GMS-2018-10 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2018-10?s=gitlab&n=lodash&t=npm&vr=%3C4.17.5 + Affected range : <4.17.5 + Fixed version : 4.17.5 + + + 1C 1H 2M 0L 1? jsonwebtoken 0.4.0 +pkg:npm/jsonwebtoken@0.4.0 + + ✗ CRITICAL CVE-2015-9235 [Improper Input Validation] + https://scout.docker.com/v/CVE-2015-9235?s=github&n=jsonwebtoken&t=npm&vr=%3C4.2.2 + Affected range : <4.2.2 + Fixed version : 4.2.2 + + ✗ HIGH CVE-2022-23539 [Use of a Broken or Risky Cryptographic Algorithm] + https://scout.docker.com/v/CVE-2022-23539?s=github&n=jsonwebtoken&t=npm&vr=%3C%3D8.5.1 + Affected range : <=8.5.1 + Fixed version : 9.0.0 + CVSS Score : 8.1 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N + + ✗ MEDIUM CVE-2022-23540 [Improper Authentication] + https://scout.docker.com/v/CVE-2022-23540?s=github&n=jsonwebtoken&t=npm&vr=%3C9.0.0 + Affected range : <9.0.0 + Fixed version : 9.0.0 + CVSS Score : 6.4 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L + + ✗ MEDIUM CVE-2022-23541 [Improper Restriction of Security Token Assignment] + https://scout.docker.com/v/CVE-2022-23541?s=github&n=jsonwebtoken&t=npm&vr=%3C%3D8.5.1 + Affected range : <=8.5.1 + Fixed version : 9.0.0 + CVSS Score : 5.0 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L + + ✗ UNSPECIFIED GMS-2015-4 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2015-4?s=gitlab&n=jsonwebtoken&t=npm&vr=%3C4.2.2 + Affected range : <4.2.2 + Fixed version : 4.2.2 + + + 1C 1H 2M 0L 1? jsonwebtoken 0.1.0 +pkg:npm/jsonwebtoken@0.1.0 + + ✗ CRITICAL CVE-2015-9235 [Improper Input Validation] + https://scout.docker.com/v/CVE-2015-9235?s=github&n=jsonwebtoken&t=npm&vr=%3C4.2.2 + Affected range : <4.2.2 + Fixed version : 4.2.2 + + ✗ HIGH CVE-2022-23539 [Use of a Broken or Risky Cryptographic Algorithm] + https://scout.docker.com/v/CVE-2022-23539?s=github&n=jsonwebtoken&t=npm&vr=%3C%3D8.5.1 + Affected range : <=8.5.1 + Fixed version : 9.0.0 + CVSS Score : 8.1 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N + + ✗ MEDIUM CVE-2022-23540 [Improper Authentication] + https://scout.docker.com/v/CVE-2022-23540?s=github&n=jsonwebtoken&t=npm&vr=%3C9.0.0 + Affected range : <9.0.0 + Fixed version : 9.0.0 + CVSS Score : 6.4 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L + + ✗ MEDIUM CVE-2022-23541 [Improper Restriction of Security Token Assignment] + https://scout.docker.com/v/CVE-2022-23541?s=github&n=jsonwebtoken&t=npm&vr=%3C%3D8.5.1 + Affected range : <=8.5.1 + Fixed version : 9.0.0 + CVSS Score : 5.0 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L + + ✗ UNSPECIFIED GMS-2015-4 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2015-4?s=gitlab&n=jsonwebtoken&t=npm&vr=%3C4.2.2 + Affected range : <4.2.2 + Fixed version : 4.2.2 + + + 1C 1H 0M 0L crypto-js 3.3.0 +pkg:npm/crypto-js@3.3.0 + + ✗ CRITICAL CVE-2023-46233 [Use of a Broken or Risky Cryptographic Algorithm] + https://scout.docker.com/v/CVE-2023-46233?s=github&n=crypto-js&t=npm&vr=%3C4.2.0 + Affected range : <4.2.0 + Fixed version : 4.2.0 + CVSS Score : 9.1 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N + + ✗ HIGH GMS-2020-4 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2020-4?s=gitlab&n=crypto-js&t=npm&vr=%3E%3D3.3.0%2C%3C4.0.0 + Affected range : >=3.3.0 + : <4.0.0 + Fixed version : 3.2.1, 4.0.0 + CVSS Score : 7.5 + CVSS Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P + + + 1C 0H 1M 0L minimist 0.2.4 +pkg:npm/minimist@0.2.4 + + ✗ CRITICAL CVE-2021-44906 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/CVE-2021-44906?s=gitlab&n=minimist&t=npm&vr=%3C1.2.6 + Affected range : <1.2.6 + Fixed version : 1.2.6 + CVSS Score : 9.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + + ✗ MEDIUM CVE-2020-7598 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/CVE-2020-7598?s=gitlab&n=minimist&t=npm&vr=%3C1.2.2 + Affected range : <1.2.2 + Fixed version : 1.2.2 + CVSS Score : 5.6 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L + + + 1C 0H 0M 0L marsdb 0.6.11 +pkg:npm/marsdb@0.6.11 + + ✗ CRITICAL GHSA-5mrr-rgp6-x4gr [Improper Neutralization of Special Elements used in a Command ('Command Injection')] + https://scout.docker.com/v/GHSA-5mrr-rgp6-x4gr?s=github&n=marsdb&t=npm&vr=%3E%3D0.0.0 + Affected range : >=0.0.0 + Fixed version : not fixed + + + 0C 6H 1M 0L tar 4.4.19 +pkg:npm/tar@4.4.19 + + ✗ HIGH CVE-2026-23950 [Improper Handling of Unicode Encoding] + https://scout.docker.com/v/CVE-2026-23950?s=github&n=tar&t=npm&vr=%3C%3D7.5.3 + Affected range : <=7.5.3 + Fixed version : 7.5.4 + CVSS Score : 8.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L + + ✗ HIGH CVE-2026-31802 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-31802?s=github&n=tar&t=npm&vr=%3C%3D7.5.10 + Affected range : <=7.5.10 + Fixed version : 7.5.11 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N + + ✗ HIGH CVE-2026-29786 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-29786?s=github&n=tar&t=npm&vr=%3C%3D7.5.9 + Affected range : <=7.5.9 + Fixed version : 7.5.10 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L + + ✗ HIGH CVE-2026-24842 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-24842?s=github&n=tar&t=npm&vr=%3C7.5.7 + Affected range : <7.5.7 + Fixed version : 7.5.7 + CVSS Score : 8.2 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N + + ✗ HIGH CVE-2026-23745 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-23745?s=github&n=tar&t=npm&vr=%3C%3D7.5.2 + Affected range : <=7.5.2 + Fixed version : 7.5.3 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N + + ✗ HIGH CVE-2026-26960 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-26960?s=github&n=tar&t=npm&vr=%3C7.5.8 + Affected range : <7.5.8 + Fixed version : 7.5.8 + CVSS Score : 7.1 + CVSS Vector : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N + + ✗ MEDIUM CVE-2024-28863 [Uncontrolled Resource Consumption] + https://scout.docker.com/v/CVE-2024-28863?s=github&n=tar&t=npm&vr=%3C6.2.1 + Affected range : <6.2.1 + Fixed version : 6.2.1 + CVSS Score : 6.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H + + + 0C 6H 0M 0L tar 7.4.3 +pkg:npm/tar@7.4.3 + + ✗ HIGH CVE-2026-23950 [Improper Handling of Unicode Encoding] + https://scout.docker.com/v/CVE-2026-23950?s=github&n=tar&t=npm&vr=%3C%3D7.5.3 + Affected range : <=7.5.3 + Fixed version : 7.5.4 + CVSS Score : 8.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L + + ✗ HIGH CVE-2026-31802 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-31802?s=github&n=tar&t=npm&vr=%3C%3D7.5.10 + Affected range : <=7.5.10 + Fixed version : 7.5.11 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N + + ✗ HIGH CVE-2026-29786 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-29786?s=github&n=tar&t=npm&vr=%3C%3D7.5.9 + Affected range : <=7.5.9 + Fixed version : 7.5.10 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L + + ✗ HIGH CVE-2026-24842 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-24842?s=github&n=tar&t=npm&vr=%3C7.5.7 + Affected range : <7.5.7 + Fixed version : 7.5.7 + CVSS Score : 8.2 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N + + ✗ HIGH CVE-2026-23745 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-23745?s=github&n=tar&t=npm&vr=%3C%3D7.5.2 + Affected range : <=7.5.2 + Fixed version : 7.5.3 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N + + ✗ HIGH CVE-2026-26960 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-26960?s=github&n=tar&t=npm&vr=%3C7.5.8 + Affected range : <7.5.8 + Fixed version : 7.5.8 + CVSS Score : 7.1 + CVSS Vector : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N + + + 0C 6H 0M 0L tar 6.2.1 +pkg:npm/tar@6.2.1 + + ✗ HIGH CVE-2026-23950 [Improper Handling of Unicode Encoding] + https://scout.docker.com/v/CVE-2026-23950?s=github&n=tar&t=npm&vr=%3C%3D7.5.3 + Affected range : <=7.5.3 + Fixed version : 7.5.4 + CVSS Score : 8.8 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L + + ✗ HIGH CVE-2026-31802 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-31802?s=github&n=tar&t=npm&vr=%3C%3D7.5.10 + Affected range : <=7.5.10 + Fixed version : 7.5.11 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N + + ✗ HIGH CVE-2026-29786 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-29786?s=github&n=tar&t=npm&vr=%3C%3D7.5.9 + Affected range : <=7.5.9 + Fixed version : 7.5.10 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L + + ✗ HIGH CVE-2026-24842 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-24842?s=github&n=tar&t=npm&vr=%3C7.5.7 + Affected range : <7.5.7 + Fixed version : 7.5.7 + CVSS Score : 8.2 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N + + ✗ HIGH CVE-2026-23745 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-23745?s=github&n=tar&t=npm&vr=%3C%3D7.5.2 + Affected range : <=7.5.2 + Fixed version : 7.5.3 + CVSS Score : 8.2 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N + + ✗ HIGH CVE-2026-26960 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2026-26960?s=github&n=tar&t=npm&vr=%3C7.5.8 + Affected range : <7.5.8 + Fixed version : 7.5.8 + CVSS Score : 7.1 + CVSS Vector : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N + + + 0C 4H 0M 0L multer 1.4.5-lts.2 +pkg:npm/multer@1.4.5-lts.2 + + ✗ HIGH CVE-2026-3520 [Uncontrolled Recursion] + https://scout.docker.com/v/CVE-2026-3520?s=github&n=multer&t=npm&vr=%3C2.1.1 + Affected range : <2.1.1 + Fixed version : 2.1.1 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2026-3304 [Incomplete Cleanup] + https://scout.docker.com/v/CVE-2026-3304?s=github&n=multer&t=npm&vr=%3C2.1.0 + Affected range : <2.1.0 + Fixed version : 2.1.0 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2026-2359 [Missing Release of Resource after Effective Lifetime] + https://scout.docker.com/v/CVE-2026-2359?s=github&n=multer&t=npm&vr=%3C2.1.0 + Affected range : <2.1.0 + Fixed version : 2.1.0 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2025-47935 [Missing Release of Memory after Effective Lifetime] + https://scout.docker.com/v/CVE-2025-47935?s=github&n=multer&t=npm&vr=%3C2.0.0 + Affected range : <2.0.0 + Fixed version : 2.0.0 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 3H 0M 0L minimatch 3.0.5 +pkg:npm/minimatch@3.0.5 + + ✗ HIGH CVE-2026-26996 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-26996?s=github&n=minimatch&t=npm&vr=%3C3.1.3 + Affected range : <3.1.3 + Fixed version : 10.2.1 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2026-27904 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-27904?s=github&n=minimatch&t=npm&vr=%3C3.1.4 + Affected range : <3.1.4 + Fixed version : 3.1.4 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + ✗ HIGH CVE-2026-27903 [Inefficient Algorithmic Complexity] + https://scout.docker.com/v/CVE-2026-27903?s=github&n=minimatch&t=npm&vr=%3C3.1.3 + Affected range : <3.1.3 + Fixed version : 3.1.3 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 3H 0M 0L minimatch 5.1.6 +pkg:npm/minimatch@5.1.6 + + ✗ HIGH CVE-2026-26996 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-26996?s=github&n=minimatch&t=npm&vr=%3E%3D5.0.0%2C%3C5.1.7 + Affected range : >=5.0.0 + : <5.1.7 + Fixed version : 10.2.1 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2026-27904 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-27904?s=github&n=minimatch&t=npm&vr=%3E%3D5.0.0%2C%3C5.1.8 + Affected range : >=5.0.0 + : <5.1.8 + Fixed version : 5.1.8 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + ✗ HIGH CVE-2026-27903 [Inefficient Algorithmic Complexity] + https://scout.docker.com/v/CVE-2026-27903?s=github&n=minimatch&t=npm&vr=%3E%3D5.0.0%2C%3C5.1.8 + Affected range : >=5.0.0 + : <5.1.8 + Fixed version : 5.1.8 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 3H 0M 0L minimatch 3.1.2 +pkg:npm/minimatch@3.1.2 + + ✗ HIGH CVE-2026-26996 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-26996?s=github&n=minimatch&t=npm&vr=%3C3.1.3 + Affected range : <3.1.3 + Fixed version : 10.2.1 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2026-27904 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-27904?s=github&n=minimatch&t=npm&vr=%3C3.1.4 + Affected range : <3.1.4 + Fixed version : 3.1.4 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + ✗ HIGH CVE-2026-27903 [Inefficient Algorithmic Complexity] + https://scout.docker.com/v/CVE-2026-27903?s=github&n=minimatch&t=npm&vr=%3C3.1.3 + Affected range : <3.1.3 + Fixed version : 3.1.3 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 3H 0M 0L minimatch 9.0.5 +pkg:npm/minimatch@9.0.5 + + ✗ HIGH CVE-2026-26996 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-26996?s=github&n=minimatch&t=npm&vr=%3E%3D9.0.0%2C%3C9.0.6 + Affected range : >=9.0.0 + : <9.0.6 + Fixed version : 10.2.1 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2026-27904 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-27904?s=github&n=minimatch&t=npm&vr=%3E%3D9.0.0%2C%3C9.0.7 + Affected range : >=9.0.0 + : <9.0.7 + Fixed version : 9.0.7 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + ✗ HIGH CVE-2026-27903 [Inefficient Algorithmic Complexity] + https://scout.docker.com/v/CVE-2026-27903?s=github&n=minimatch&t=npm&vr=%3E%3D9.0.0%2C%3C9.0.7 + Affected range : >=9.0.0 + : <9.0.7 + Fixed version : 9.0.7 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 3H 0M 0L minimatch 3.0.8 +pkg:npm/minimatch@3.0.8 + + ✗ HIGH CVE-2026-26996 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-26996?s=github&n=minimatch&t=npm&vr=%3C3.1.3 + Affected range : <3.1.3 + Fixed version : 10.2.1 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ HIGH CVE-2026-27904 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-27904?s=github&n=minimatch&t=npm&vr=%3C3.1.4 + Affected range : <3.1.4 + Fixed version : 3.1.4 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + ✗ HIGH CVE-2026-27903 [Inefficient Algorithmic Complexity] + https://scout.docker.com/v/CVE-2026-27903?s=github&n=minimatch&t=npm&vr=%3C3.1.3 + Affected range : <3.1.3 + Fixed version : 3.1.3 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 2H 1M 0L 1? moment 2.0.0 +pkg:npm/moment@2.0.0 + + ✗ HIGH CVE-2022-24785 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2022-24785?s=github&n=moment&t=npm&vr=%3C2.29.2 + Affected range : <2.29.2 + Fixed version : 2.29.2 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N + + ✗ HIGH CVE-2017-18214 [Uncontrolled Resource Consumption] + https://scout.docker.com/v/CVE-2017-18214?s=github&n=moment&t=npm&vr=%3C2.19.3 + Affected range : <2.19.3 + Fixed version : 2.19.3 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + ✗ MEDIUM CVE-2016-4055 [Uncontrolled Resource Consumption] + https://scout.docker.com/v/CVE-2016-4055?s=github&n=moment&t=npm&vr=%3C2.11.2 + Affected range : <2.11.2 + Fixed version : 2.11.2 + CVSS Score : 6.5 + CVSS Vector : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H + + ✗ UNSPECIFIED GMS-2017-332 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2017-332?s=gitlab&n=moment&t=npm&vr=%3C2.19.3 + Affected range : <2.19.3 + Fixed version : 2.19.3 + + + 0C 2H 0M 0L 1? jws 0.2.6 +pkg:npm/jws@0.2.6 + + ✗ HIGH CVE-2016-1000223 + https://scout.docker.com/v/CVE-2016-1000223?s=github&n=jws&t=npm&vr=%3C3.0.0 + Affected range : <3.0.0 + Fixed version : 3.0.0 + CVSS Score : 8.7 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N + + ✗ HIGH CVE-2025-65945 [Improper Verification of Cryptographic Signature] + https://scout.docker.com/v/CVE-2025-65945?s=github&n=jws&t=npm&vr=%3C3.2.3 + Affected range : <3.2.3 + Fixed version : 3.2.3 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N + + ✗ UNSPECIFIED GMS-2016-54 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2016-54?s=gitlab&n=jws&t=npm&vr=%3C3.0.0 + Affected range : <3.0.0 + Fixed version : 3.0.0 + + + 0C 1H 6M 0L 2? sanitize-html 1.4.2 +pkg:npm/sanitize-html@1.4.2 + + ✗ HIGH CVE-2022-25887 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2022-25887?s=github&n=sanitize-html&t=npm&vr=%3C2.7.1 + Affected range : <2.7.1 + Fixed version : 2.7.1 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + ✗ MEDIUM CVE-2019-25225 [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] + https://scout.docker.com/v/CVE-2019-25225?s=github&n=sanitize-html&t=npm&vr=%3C2.0.0-beta + Affected range : <2.0.0-beta + Fixed version : 2.0.0-beta + CVSS Score : 6.1 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + + ✗ MEDIUM CVE-2016-1000237 [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] + https://scout.docker.com/v/CVE-2016-1000237?s=github&n=sanitize-html&t=npm&vr=%3C1.4.3 + Affected range : <1.4.3 + Fixed version : 1.4.3 + CVSS Score : 6.1 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + + ✗ MEDIUM CVE-2024-21501 [Exposure of Sensitive Information to an Unauthorized Actor] + https://scout.docker.com/v/CVE-2024-21501?s=github&n=sanitize-html&t=npm&vr=%3C2.12.1 + Affected range : <2.12.1 + Fixed version : 2.12.1 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + + ✗ MEDIUM CVE-2021-26540 [Improper Input Validation] + https://scout.docker.com/v/CVE-2021-26540?s=github&n=sanitize-html&t=npm&vr=%3C2.3.2 + Affected range : <2.3.2 + Fixed version : 2.3.2 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + + ✗ MEDIUM CVE-2021-26539 [Improper Input Validation] + https://scout.docker.com/v/CVE-2021-26539?s=github&n=sanitize-html&t=npm&vr=%3C2.3.1 + Affected range : <2.3.1 + Fixed version : 2.3.1 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + + ✗ MEDIUM CVE-2017-16016 [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] + https://scout.docker.com/v/CVE-2017-16016?s=github&n=sanitize-html&t=npm&vr=%3C%3D1.11.1 + Affected range : <=1.11.1 + Fixed version : 1.11.4 + + ✗ UNSPECIFIED GMS-2016-57 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2016-57?s=gitlab&n=sanitize-html&t=npm&vr=%3C%3D1.4.2 + Affected range : <=1.4.2 + Fixed version : 1.4.3 + + ✗ UNSPECIFIED GMS-2016-17 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GMS-2016-17?s=gitlab&n=sanitize-html&t=npm&vr=%3C1.11.4 + Affected range : <1.11.4 + Fixed version : 1.11.4 + + + 0C 1H 1M 0L socket.io 3.1.2 +pkg:npm/socket.io@3.1.2 + + ✗ HIGH GHSA-25hc-qcg6-38wj [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/GHSA-25hc-qcg6-38wj?s=gitlab&n=socket.io&t=npm&vr=%3E%3D3.0.0%2C%3C4.6.2 + Affected range : >=3.0.0 + : <4.6.2 + Fixed version : 2.5.1, 4.6.2 + CVSS Score : 7.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L + + ✗ MEDIUM CVE-2024-38355 [Improper Input Validation] + https://scout.docker.com/v/CVE-2024-38355?s=github&n=socket.io&t=npm&vr=%3E%3D3.0.0%2C%3C4.6.2 + Affected range : >=3.0.0 + : <4.6.2 + Fixed version : 4.6.2 + CVSS Score : 6.9 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N + + + 0C 1H 1M 0L validator 13.15.15 +pkg:npm/validator@13.15.15 + + ✗ HIGH CVE-2025-12758 [Encoding Error] + https://scout.docker.com/v/CVE-2025-12758?s=github&n=validator&t=npm&vr=%3C13.15.22 + Affected range : <13.15.22 + Fixed version : 13.15.22 + CVSS Score : 7.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P + + ✗ MEDIUM CVE-2025-56200 [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] + https://scout.docker.com/v/CVE-2025-56200?s=github&n=validator&t=npm&vr=%3C13.15.20 + Affected range : <13.15.20 + Fixed version : 13.15.20 + CVSS Score : 6.1 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + + + 0C 1H 1M 0L socket.io-parser 4.0.5 +pkg:npm/socket.io-parser@4.0.5 + + ✗ HIGH CVE-2026-33151 [Improper Check for Unusual or Exceptional Conditions] + https://scout.docker.com/v/CVE-2026-33151?s=github&n=socket.io-parser&t=npm&vr=%3E%3D4.0.0%2C%3C4.2.6 + Affected range : >=4.0.0 + : <4.2.6 + Fixed version : 4.2.6 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + ✗ MEDIUM CVE-2023-32695 [Improper Input Validation] + https://scout.docker.com/v/CVE-2023-32695?s=github&n=socket.io-parser&t=npm&vr=%3E%3D4.0.4%2C%3C4.2.3 + Affected range : >=4.0.4 + : <4.2.3 + Fixed version : 4.2.3 + CVSS Score : 6.9 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N + + + 0C 1H 0M 0L braces 2.3.2 +pkg:npm/braces@2.3.2 + + ✗ HIGH CVE-2024-4068 [Excessive Platform Resource Consumption within a Loop] + https://scout.docker.com/v/CVE-2024-4068?s=github&n=braces&t=npm&vr=%3C3.0.3 + Affected range : <3.0.3 + Fixed version : 3.0.3 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 1H 0M 0L sequelize 6.37.7 +pkg:npm/sequelize@6.37.7 + + ✗ HIGH CVE-2026-30951 [Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')] + https://scout.docker.com/v/CVE-2026-30951?s=github&n=sequelize&t=npm&vr=%3E%3D6.0.0-beta.1%2C%3C%3D6.37.7 + Affected range : >=6.0.0-beta.1 + : <=6.37.7 + Fixed version : 6.37.8 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + + + 0C 1H 0M 0L express-jwt 0.1.3 +pkg:npm/express-jwt@0.1.3 + + ✗ HIGH CVE-2020-15084 [Improper Authorization] + https://scout.docker.com/v/CVE-2020-15084?s=github&n=express-jwt&t=npm&vr=%3C%3D5.3.3 + Affected range : <=5.3.3 + Fixed version : 6.0.0 + CVSS Score : 7.7 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N + + + 0C 1H 0M 0L glob 10.4.5 +pkg:npm/glob@10.4.5 + + ✗ HIGH CVE-2025-64756 [Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')] + https://scout.docker.com/v/CVE-2025-64756?s=github&n=glob&t=npm&vr=%3E%3D10.2.0%2C%3C10.5.0 + Affected range : >=10.2.0 + : <10.5.0 + Fixed version : 11.1.0 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H + + + 0C 1H 0M 0L tar-fs 2.1.3 +pkg:npm/tar-fs@2.1.3 + + ✗ HIGH CVE-2025-59343 [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')] + https://scout.docker.com/v/CVE-2025-59343?s=github&n=tar-fs&t=npm&vr=%3E%3D2.0.0%2C%3C2.1.4 + Affected range : >=2.0.0 + : <2.1.4 + Fixed version : 2.1.4 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N + + + 0C 1H 0M 0L mout 1.2.4 +pkg:npm/mout@1.2.4 + + ✗ HIGH CVE-2020-7792 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/CVE-2020-7792?s=gitlab&n=mout&t=npm&vr=%3E%3D0 + Affected range : >=0 + Fixed version : not fixed + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 1H 0M 0L ws 7.4.6 +pkg:npm/ws@7.4.6 + + ✗ HIGH CVE-2024-37890 [NULL Pointer Dereference] + https://scout.docker.com/v/CVE-2024-37890?s=github&n=ws&t=npm&vr=%3E%3D7.0.0%2C%3C7.5.10 + Affected range : >=7.0.0 + : <7.5.10 + Fixed version : 7.5.10 + CVSS Score : 8.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N + + + 0C 1H 0M 0L lodash.set 4.3.2 +pkg:npm/lodash.set@4.3.2 + + ✗ HIGH CVE-2020-8203 [Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')] + https://scout.docker.com/v/CVE-2020-8203?s=github&n=lodash.set&t=npm&vr=%3E%3D3.7.0%2C%3C%3D4.3.2 + Affected range : >=3.7.0 + : <=4.3.2 + Fixed version : not fixed + CVSS Score : 7.4 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H + + + 0C 1H 0M 0L http-cache-semantics 3.8.1 +pkg:npm/http-cache-semantics@3.8.1 + + ✗ HIGH CVE-2022-25881 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2022-25881?s=github&n=http-cache-semantics&t=npm&vr=%3C4.1.1 + Affected range : <4.1.1 + Fixed version : 4.1.1 + CVSS Score : 7.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + + + 0C 1H 0M 0L ip 2.0.1 +pkg:npm/ip@2.0.1 + + ✗ HIGH CVE-2024-29415 [Server-Side Request Forgery (SSRF)] + https://scout.docker.com/v/CVE-2024-29415?s=github&n=ip&t=npm&vr=%3C%3D2.0.1 + Affected range : <=2.0.1 + Fixed version : not fixed + CVSS Score : 8.1 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H + + + 0C 0H 1M 1L qs 6.13.0 +pkg:npm/qs@6.13.0 + + ✗ MEDIUM CVE-2025-15284 [Improper Input Validation] + https://scout.docker.com/v/CVE-2025-15284?s=github&n=qs&t=npm&vr=%3C6.14.1 + Affected range : <6.14.1 + Fixed version : 6.14.1 + CVSS Score : 6.3 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L + + ✗ LOW CVE-2026-2391 [Improper Input Validation] + https://scout.docker.com/v/CVE-2026-2391?s=github&n=qs&t=npm&vr=%3E%3D6.7.0%2C%3C%3D6.14.1 + Affected range : >=6.7.0 + : <=6.14.1 + Fixed version : 6.14.2 + CVSS Score : 3.7 + CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L + + + 0C 0H 1M 0L base64url 0.0.6 +pkg:npm/base64url@0.0.6 + + ✗ MEDIUM GHSA-rvg8-pwq2-xj7q [Out-of-bounds Read] + https://scout.docker.com/v/GHSA-rvg8-pwq2-xj7q?s=github&n=base64url&t=npm&vr=%3C3.0.0 + Affected range : <3.0.0 + Fixed version : 3.0.0 + + + 0C 0H 1M 0L got 8.3.2 +pkg:npm/got@8.3.2 + + ✗ MEDIUM CVE-2022-33987 + https://scout.docker.com/v/CVE-2022-33987?s=github&n=got&t=npm&vr=%3C11.8.5 + Affected range : <11.8.5 + Fixed version : 11.8.5 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + + + 0C 0H 1M 0L lodash 4.17.21 +pkg:npm/lodash@4.17.21 + + ✗ MEDIUM CVE-2025-13465 [Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')] + https://scout.docker.com/v/CVE-2025-13465?s=github&n=lodash&t=npm&vr=%3E%3D4.0.0%2C%3C%3D4.17.22 + Affected range : >=4.0.0 + : <=4.17.22 + Fixed version : 4.17.23 + CVSS Score : 6.9 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P + + + 0C 0H 1M 0L engine.io 4.1.2 +pkg:npm/engine.io@4.1.2 + + ✗ MEDIUM CVE-2022-41940 [Uncaught Exception] + https://scout.docker.com/v/CVE-2022-41940?s=github&n=engine.io&t=npm&vr=%3E%3D4.0.0%2C%3C6.2.1 + Affected range : >=4.0.0 + : <6.2.1 + Fixed version : 6.2.1 + CVSS Score : 6.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H + + + 0C 0H 1M 0L js-yaml 3.14.1 +pkg:npm/js-yaml@3.14.1 + + ✗ MEDIUM CVE-2025-64718 [Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')] + https://scout.docker.com/v/CVE-2025-64718?s=github&n=js-yaml&t=npm&vr=%3C3.14.2 + Affected range : <3.14.2 + Fixed version : 4.1.1 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N + + + 0C 0H 1M 0L dottie 2.0.6 +pkg:npm/dottie@2.0.6 + + ✗ MEDIUM CVE-2026-27837 [Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')] + https://scout.docker.com/v/CVE-2026-27837?s=github&n=dottie&t=npm&vr=%3E%3D2.0.4%2C%3C%3D2.0.6 + Affected range : >=2.0.4 + : <=2.0.6 + Fixed version : 2.0.7 + CVSS Score : 6.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L + + + 0C 0H 1M 0L hbs 4.2.0 +pkg:npm/hbs@4.2.0 + + ✗ MEDIUM CVE-2021-32822 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities] + https://scout.docker.com/v/CVE-2021-32822?s=gitlab&n=hbs&t=npm&vr=%3E%3D0 + Affected range : >=0 + Fixed version : not fixed + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N + + + 0C 0H 1M 0L micromatch 3.1.10 +pkg:npm/micromatch@3.1.10 + + ✗ MEDIUM CVE-2024-4067 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2024-4067?s=github&n=micromatch&t=npm&vr=%3C4.0.8 + Affected range : <4.0.8 + Fixed version : 4.0.8 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L + + + 0C 0H 1M 0L notevil 1.3.3 +pkg:npm/notevil@1.3.3 + + ✗ MEDIUM CVE-2021-23771 [Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')] + https://scout.docker.com/v/CVE-2021-23771?s=github&n=notevil&t=npm&vr=%3C%3D1.3.3 + Affected range : <=1.3.3 + Fixed version : not fixed + CVSS Score : 6.5 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N + + + 0C 0H 1M 0L file-type 16.5.4 +pkg:npm/file-type@16.5.4 + + ✗ MEDIUM CVE-2026-31808 [Loop with Unreachable Exit Condition ('Infinite Loop')] + https://scout.docker.com/v/CVE-2026-31808?s=github&n=file-type&t=npm&vr=%3E%3D13.0.0%2C%3C21.3.1 + Affected range : >=13.0.0 + : <21.3.1 + Fixed version : 21.3.1 + CVSS Score : 5.3 + CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L + + + 0C 0H 0M 1L diff 4.0.2 +pkg:npm/diff@4.0.2 + + ✗ LOW CVE-2026-24001 [Inefficient Regular Expression Complexity] + https://scout.docker.com/v/CVE-2026-24001?s=github&n=diff&t=npm&vr=%3E%3D4.0.0%2C%3C4.0.4 + Affected range : >=4.0.0 + : <4.0.4 + Fixed version : 4.0.4 + CVSS Score : 2.7 + CVSS Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U + + + 0C 0H 0M 1L @tootallnate/once 2.0.0 +pkg:npm/%40tootallnate/once@2.0.0 + + ✗ LOW CVE-2026-3449 [Incorrect Control Flow Scoping] + https://scout.docker.com/v/CVE-2026-3449?s=github&n=once&ns=%40tootallnate&t=npm&vr=%3C3.0.1 + Affected range : <3.0.1 + Fixed version : 3.0.1 + CVSS Score : 1.9 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P + + + 0C 0H 0M 1L @tootallnate/once 1.1.2 +pkg:npm/%40tootallnate/once@1.1.2 + + ✗ LOW CVE-2026-3449 [Incorrect Control Flow Scoping] + https://scout.docker.com/v/CVE-2026-3449?s=github&n=once&ns=%40tootallnate&t=npm&vr=%3C3.0.1 + Affected range : <3.0.1 + Fixed version : 3.0.1 + CVSS Score : 1.9 + CVSS Vector : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P + + + 0C 0H 0M 1L cookie 0.4.2 +pkg:npm/cookie@0.4.2 + + ✗ LOW CVE-2024-47764 [Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')] + https://scout.docker.com/v/CVE-2024-47764?s=github&n=cookie&t=npm&vr=%3C0.7.0 + Affected range : <0.7.0 + Fixed version : 0.7.0 + + + +118 vulnerabilities found in 48 packages + CRITICAL 11 + HIGH 65 + MEDIUM 30 + LOW 5 + UNSPECIFIED 7 + + +What's next: + View base image update recommendations → docker scout recommendations bkimminich/juice-shop:v19.0.0 + diff --git a/labs/lab7/scanning/scout-quickview.txt b/labs/lab7/scanning/scout-quickview.txt new file mode 100644 index 00000000..f723ac9b --- /dev/null +++ b/labs/lab7/scanning/scout-quickview.txt @@ -0,0 +1,13 @@ + ✓ SBOM of image already cached, 1004 packages indexed + + i Base image was auto-detected. To get more accurate results, build images with max-mode provenance attestations. + Review https://docs.docker.com/build/attestations/slsa-provenance/ for more information. + + Target │ bkimminich/juice-shop:v19.0.0 │ 11C 65H 30M 5L 7? + digest │ 37cc73163c4c │ + Base image │ distroless/static:nonroot │ 0C 0H 0M 0L + +What's next: + View vulnerabilities → docker scout cves bkimminich/juice-shop:v19.0.0 + Include policy results in your quickview by supplying an organization → docker scout quickview bkimminich/juice-shop:v19.0.0 --org + diff --git a/labs/lab7/scanning/snyk-results.txt b/labs/lab7/scanning/snyk-results.txt new file mode 100644 index 00000000..41ff9540 --- /dev/null +++ b/labs/lab7/scanning/snyk-results.txt @@ -0,0 +1,255 @@ + +Testing bkimminich/juice-shop:v19.0.0... + +✗ High severity vulnerability found in openssl/libssl3 + Description: CVE-2025-69421 + Info: https://security.snyk.io/vuln/SNYK-DEBIAN12-OPENSSL-15123192 + Introduced through: openssl/libssl3@3.0.17-1~deb12u2 + From: openssl/libssl3@3.0.17-1~deb12u2 + Fixed in: 3.0.18-1~deb12u2 + +------------ Detected 5 vulnerabilities for node@22.18.0 ------------ + + +✗ High severity vulnerability found in node + Description: UNIX Symbolic Link (Symlink) Following + Info: https://security.snyk.io/vuln/SNYK-UPSTREAM-NODE-14928586 + Introduced through: node@22.18.0 + From: node@22.18.0 + Fixed in: 22.22.0 + +✗ High severity vulnerability found in node + Description: Uncaught Exception + Info: https://security.snyk.io/vuln/SNYK-UPSTREAM-NODE-14929624 + Introduced through: node@22.18.0 + From: node@22.18.0 + Fixed in: 22.22.0 + +✗ High severity vulnerability found in node + Description: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior + Info: https://security.snyk.io/vuln/SNYK-UPSTREAM-NODE-14975915 + Introduced through: node@22.18.0 + From: node@22.18.0 + Fixed in: 22.22.0 + +✗ High severity vulnerability found in node + Description: Uncaught Exception + Info: https://security.snyk.io/vuln/SNYK-UPSTREAM-NODE-14982196 + Introduced through: node@22.18.0 + From: node@22.18.0 + Fixed in: 22.22.0 + +✗ Critical severity vulnerability found in node + Description: Race Condition + Info: https://security.snyk.io/vuln/SNYK-UPSTREAM-NODE-14928492 + Introduced through: node@22.18.0 + From: node@22.18.0 + Fixed in: 22.22.0 + +Organization: rash1d1 +Package manager: deb +Project name: docker-image|bkimminich/juice-shop +Docker image: bkimminich/juice-shop:v19.0.0 +Platform: linux/amd64 +Target OS: Distroless +Licenses: enabled + +Tested 10 dependencies for known issues, found 6 issues. + +------------------------------------------------------- + +Testing bkimminich/juice-shop:v19.0.0... + +Tested 975 dependencies for known issues, found 47 issues. + + +Issues to fix by upgrading: + + Upgrade body-parser@1.20.3 to body-parser@1.20.4 to fix + ✗ Allocation of Resources Without Limits or Throttling [High Severity][https://security.snyk.io/vuln/SNYK-JS-QS-14724253] in qs@6.13.0 + introduced by body-parser@1.20.3 > qs@6.13.0 and 2 other path(s) + ✗ Allocation of Resources Without Limits or Throttling [High Severity][https://security.snyk.io/vuln/SNYK-JS-QS-15268416] in qs@6.13.0 + introduced by body-parser@1.20.3 > qs@6.13.0 and 2 other path(s) + + Upgrade check-dependencies@1.1.1 to check-dependencies@2.0.0 to fix + ✗ Excessive Platform Resource Consumption within a Loop [High Severity][https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727] in braces@2.3.2 + introduced by check-dependencies@1.1.1 > findup-sync@2.0.0 > micromatch@3.1.10 > braces@2.3.2 + ✗ Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660] in unset-value@1.0.0 + introduced by check-dependencies@1.1.1 > findup-sync@2.0.0 > micromatch@3.1.10 > snapdragon@0.8.2 > base@0.11.2 > cache-base@1.0.1 > unset-value@1.0.0 and 4 other path(s) + + Upgrade express@4.21.2 to express@4.22.0 to fix + ✗ Allocation of Resources Without Limits or Throttling [High Severity][https://security.snyk.io/vuln/SNYK-JS-QS-14724253] in qs@6.13.0 + introduced by body-parser@1.20.3 > qs@6.13.0 and 2 other path(s) + ✗ Allocation of Resources Without Limits or Throttling [High Severity][https://security.snyk.io/vuln/SNYK-JS-QS-15268416] in qs@6.13.0 + introduced by body-parser@1.20.3 > qs@6.13.0 and 2 other path(s) + + Upgrade express-ipfilter@1.3.2 to express-ipfilter@1.4.0 to fix + ✗ Server-side Request Forgery (SSRF) [High Severity][https://security.snyk.io/vuln/SNYK-JS-IP-12704893] in ip@2.0.1 + introduced by express-ipfilter@1.3.2 > ip@2.0.1 + ✗ Server-side Request Forgery (SSRF) [High Severity][https://security.snyk.io/vuln/SNYK-JS-IP-12761655] in ip@2.0.1 + introduced by express-ipfilter@1.3.2 > ip@2.0.1 + + Upgrade express-jwt@0.1.3 to express-jwt@6.0.0 to fix + ✗ Authorization Bypass [High Severity][https://security.snyk.io/vuln/SNYK-JS-EXPRESSJWT-575022] in express-jwt@0.1.3 + introduced by express-jwt@0.1.3 + ✗ Improper Verification of Cryptographic Signature [High Severity][https://security.snyk.io/vuln/SNYK-JS-JWS-14188253] in jws@0.2.6 + introduced by jsonwebtoken@0.4.0 > jws@0.2.6 and 1 other path(s) + ✗ Forgeable Public/Private Tokens [High Severity][https://security.snyk.io/vuln/npm:jws:20160726] in jws@0.2.6 + introduced by jsonwebtoken@0.4.0 > jws@0.2.6 and 1 other path(s) + ✗ Directory Traversal [High Severity][https://security.snyk.io/vuln/SNYK-JS-MOMENT-2440688] in moment@2.0.0 + introduced by express-jwt@0.1.3 > jsonwebtoken@0.1.0 > moment@2.0.0 + ✗ Uninitialized Memory Exposure [High Severity][https://security.snyk.io/vuln/npm:base64url:20180511] in base64url@0.0.6 + introduced by jsonwebtoken@0.4.0 > jws@0.2.6 > base64url@0.0.6 and 3 other path(s) + ✗ Authentication Bypass [High Severity][https://security.snyk.io/vuln/npm:jsonwebtoken:20150331] in jsonwebtoken@0.1.0 + introduced by express-jwt@0.1.3 > jsonwebtoken@0.1.0 and 1 other path(s) + + Upgrade glob@10.4.5 to glob@12.0.0 to fix + ✗ Command Injection [High Severity][https://security.snyk.io/vuln/SNYK-JS-GLOB-14040952] in glob@10.4.5 + introduced by glob@10.4.5 and 1 other path(s) + ✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15309438] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + ✗ Regular Expression Denial of Service (ReDoS) (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353387] in minimatch@9.0.5 + introduced by glob@10.4.5 > minimatch@9.0.5 and 1 other path(s) + ✗ Inefficient Algorithmic Complexity (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353389] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + + Upgrade grunt-contrib-compress@1.6.0 to grunt-contrib-compress@2.0.0 to fix + ✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15309438] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + ✗ Inefficient Algorithmic Complexity (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353389] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + + Upgrade jsonwebtoken@0.4.0 to jsonwebtoken@5.0.0 to fix + ✗ Improper Verification of Cryptographic Signature [High Severity][https://security.snyk.io/vuln/SNYK-JS-JWS-14188253] in jws@0.2.6 + introduced by jsonwebtoken@0.4.0 > jws@0.2.6 and 1 other path(s) + ✗ Forgeable Public/Private Tokens [High Severity][https://security.snyk.io/vuln/npm:jws:20160726] in jws@0.2.6 + introduced by jsonwebtoken@0.4.0 > jws@0.2.6 and 1 other path(s) + ✗ Uninitialized Memory Exposure [High Severity][https://security.snyk.io/vuln/npm:base64url:20180511] in base64url@0.0.6 + introduced by jsonwebtoken@0.4.0 > jws@0.2.6 > base64url@0.0.6 and 3 other path(s) + ✗ Authentication Bypass [High Severity][https://security.snyk.io/vuln/npm:jsonwebtoken:20150331] in jsonwebtoken@0.1.0 + introduced by express-jwt@0.1.3 > jsonwebtoken@0.1.0 and 1 other path(s) + + Upgrade multer@1.4.5-lts.2 to multer@2.1.1 to fix + ✗ Uncontrolled Recursion (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-15417528] in multer@1.4.5-lts.2 + introduced by multer@1.4.5-lts.2 + ✗ Missing Release of Resource after Effective Lifetime (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-15365916] in multer@1.4.5-lts.2 + introduced by multer@1.4.5-lts.2 + ✗ Incomplete Cleanup (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-15365918] in multer@1.4.5-lts.2 + introduced by multer@1.4.5-lts.2 + ✗ Uncaught Exception [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-10773732] in multer@1.4.5-lts.2 + introduced by multer@1.4.5-lts.2 + ✗ Uncaught Exception [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-10185673] in multer@1.4.5-lts.2 + introduced by multer@1.4.5-lts.2 + ✗ Missing Release of Memory after Effective Lifetime [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-10185675] in multer@1.4.5-lts.2 + introduced by multer@1.4.5-lts.2 + ✗ Uncaught Exception [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-10299078] in multer@1.4.5-lts.2 + introduced by multer@1.4.5-lts.2 + + Upgrade node-pre-gyp@0.15.0 to node-pre-gyp@0.17.0 to fix + ✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15309438] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + ✗ Inefficient Algorithmic Complexity (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353389] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + + Upgrade pdfkit@0.11.0 to pdfkit@0.12.2 to fix + ✗ Use of Weak Hash [High Severity][https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-6028119] in crypto-js@3.3.0 + introduced by pdfkit@0.11.0 > crypto-js@3.3.0 + + Upgrade sanitize-html@1.4.2 to sanitize-html@1.7.1 to fix + ✗ Code Injection [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASH-1040724] in lodash@2.4.2 + introduced by sanitize-html@1.4.2 > lodash@2.4.2 + ✗ Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASH-450202] in lodash@2.4.2 + introduced by sanitize-html@1.4.2 > lodash@2.4.2 + ✗ Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASH-608086] in lodash@2.4.2 + introduced by sanitize-html@1.4.2 > lodash@2.4.2 + ✗ Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASH-6139239] in lodash@2.4.2 + introduced by sanitize-html@1.4.2 > lodash@2.4.2 + ✗ Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASH-73638] in lodash@2.4.2 + introduced by sanitize-html@1.4.2 > lodash@2.4.2 + + Upgrade sequelize@6.37.7 to sequelize@6.37.8 to fix + ✗ SQL Injection (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-15456219] in sequelize@6.37.7 + introduced by sequelize@6.37.7 + + Upgrade socket.io@3.1.2 to socket.io@4.7.0 to fix + ✗ Denial of Service (DoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-WS-7266574] in ws@7.4.6 + introduced by socket.io@3.1.2 > engine.io@4.1.2 > ws@7.4.6 + ✗ Uncaught Exception [High Severity][https://security.snyk.io/vuln/SNYK-JS-SOCKETIO-7278048] in socket.io@3.1.2 + introduced by socket.io@3.1.2 + ✗ Allocation of Resources Without Limits or Throttling (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-15680278] in socket.io-parser@4.0.5 + introduced by socket.io@3.1.2 > socket.io-parser@4.0.5 + ✗ Denial of Service (DoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-5596892] in socket.io-parser@4.0.5 + introduced by socket.io@3.1.2 > socket.io-parser@4.0.5 + ✗ Denial of Service (DoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-ENGINEIO-3136336] in engine.io@4.1.2 + introduced by socket.io@3.1.2 > engine.io@4.1.2 + + Upgrade sqlite3@5.1.7 to sqlite3@6.0.1 to fix + ✗ Directory Traversal [High Severity][https://security.snyk.io/vuln/SNYK-JS-TAR-15307072] in tar@7.4.3 + introduced by libxmljs2@0.37.0 > node-gyp@11.4.2 > tar@7.4.3 and 5 other path(s) + ✗ Symlink Attack (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-TAR-15416075] in tar@7.4.3 + introduced by libxmljs2@0.37.0 > node-gyp@11.4.2 > tar@7.4.3 and 5 other path(s) + ✗ Symlink Attack (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-TAR-15456201] in tar@7.4.3 + introduced by libxmljs2@0.37.0 > node-gyp@11.4.2 > tar@7.4.3 and 5 other path(s) + + Upgrade unzipper@0.9.15 to unzipper@0.12.1 to fix + ✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15309438] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + ✗ Inefficient Algorithmic Complexity (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353389] in minimatch@3.1.2 + introduced by filesniffer@1.0.3 > filehound@1.17.6 > file-js@0.3.0 > minimatch@3.1.2 and 18 other path(s) + + +Issues with no direct upgrade or patch: + ✗ Type Confusion [High Severity][https://security.snyk.io/vuln/SNYK-JS-LIBXMLJS2-6808810] in libxmljs2@0.37.0 + introduced by libxmljs2@0.37.0 + No upgrade or patch available + ✗ Type Confusion [High Severity][https://security.snyk.io/vuln/SNYK-JS-LIBXMLJS2-6808816] in libxmljs2@0.37.0 + introduced by libxmljs2@0.37.0 + No upgrade or patch available + ✗ Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032] in lodash.set@4.3.2 + introduced by grunt-replace-json@0.1.0 > lodash.set@4.3.2 + No upgrade or patch available + ✗ Arbitrary Code Injection [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-MARSDB-480405] in marsdb@0.6.11 + introduced by marsdb@0.6.11 + No upgrade or patch available + ✗ Incomplete Filtering of One or More Instances of Special Elements [High Severity][https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476] in validator@13.15.15 + introduced by sequelize@6.37.7 > validator@13.15.15 + This issue was fixed in versions: 13.15.22 + ✗ Improper Control of Dynamically-Managed Code Resources [High Severity][https://security.snyk.io/vuln/SNYK-JS-VM2-15116160] in vm2@3.9.17 + introduced by juicy-chat-bot@0.9.0 > vm2@3.9.17 + This issue was fixed in versions: 3.10.2 + ✗ Sandbox Bypass [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-VM2-5537100] in vm2@3.9.17 + introduced by juicy-chat-bot@0.9.0 > vm2@3.9.17 + This issue was fixed in versions: 3.9.18 + ✗ Remote Code Execution (RCE) [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-VM2-5772823] in vm2@3.9.17 + introduced by juicy-chat-bot@0.9.0 > vm2@3.9.17 + This issue was fixed in versions: 3.10.0 + ✗ Remote Code Execution (RCE) [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-VM2-5772825] in vm2@3.9.17 + introduced by juicy-chat-bot@0.9.0 > vm2@3.9.17 + This issue was fixed in versions: 3.10.0 + + + +Organization: rash1d1 +Package manager: npm +Target file: /juice-shop/package.json +Project name: juice-shop +Docker image: bkimminich/juice-shop:v19.0.0 +Licenses: enabled + + +Tested 2 projects, 2 contained vulnerable paths. + + + + + ERROR Forbidden (SNYK-CLI-0000) + The encountered error only provides basic information, please take a look at + the given details. If they do not help to resolve the issue, consider + debugging or consulting support. + + Forbidden + +Status: 403 Forbidden +Docs: https://docs.snyk.io/scan-with-snyk/error-catalog#snyk-cli-0000 + +ID: urn:snyk:interaction:2f311090-8d68-4b8a-9359-9786966da09e diff --git a/labs/submission7.md b/labs/submission7.md new file mode 100644 index 00000000..98817d9e --- /dev/null +++ b/labs/submission7.md @@ -0,0 +1,220 @@ +# Lab 7 — Container Security: Image Scanning & Deployment Hardening + +**Date:** March 22, 2026 +**Branch:** `feature/lab7` +**Target image:** `bkimminich/juice-shop:v19.0.0` + +## Task 1 — Image Vulnerability & Configuration Analysis + +### Scanner Execution Summary + +- `Docker Scout` completed with authenticated results: + - `quickview`: `11C 65H 30M 5L 7?` for `bkimminich/juice-shop:v19.0.0` + - `cves`: `48 vulnerable packages` and `87 vulnerabilities` total + - base image auto-detected as `distroless/static:nonroot` with `0C 0H 0M 0L` + - Evidence: `labs/lab7/scanning/scout-quickview.txt`, `labs/lab7/scanning/scout-cves.txt` +- `Snyk` scan executed successfully far enough to produce both OS and application findings: + - OS/base scan: `Tested 10 dependencies ... found 6 issues` + - App dependency scan: `Tested 975 dependencies ... found 47 issues` + - Final command ended with `403 Forbidden` after findings were printed (report content still captured). + - Evidence: `labs/lab7/scanning/snyk-results.txt` +- `Dockle` image configuration scan completed. + - Evidence: `labs/lab7/scanning/dockle-results.txt` + +### Top 5 Critical/High Vulnerabilities + +| # | CVE / Advisory | Package | Severity | Impact | Fixed Version | +|---|---|---|---|---|---| +| 1 | `CVE-2026-22709` (Scout) | `vm2@3.9.17` | Critical | Sandbox protection failure can enable code execution escape | `3.10.2` | +| 2 | `CVE-2023-37903` (Scout) | `vm2@3.9.17` | Critical | OS command injection in JavaScript sandbox dependency | No fixed version | +| 3 | `CVE-2025-55130` (Scout) | `node@22.18.0` | Critical | Critical runtime vulnerability in Node.js engine used by app | `22.22.0` | +| 4 | `CVE-2019-10744` (Scout) | `lodash@2.4.2` | Critical | Prototype pollution can lead to application logic compromise | `4.17.12` | +| 5 | `CVE-2025-69421` (`SNYK-DEBIAN12-OPENSSL-15123192`) | `openssl/libssl3@3.0.17-1~deb12u2` | High | TLS/crypto issue in OS layer impacting confidentiality/integrity | `3.0.18-1~deb12u2` | + +### Dockle Configuration Findings + +`Dockle` produced **no `FATAL` and no `WARN`** findings in this run, but reported security-relevant `INFO` items: + +- `CIS-DI-0005`: Content trust is not enabled. + - Risk: image provenance/signing verification is not enforced, increasing supply-chain tampering risk. +- `CIS-DI-0006`: No `HEALTHCHECK` instruction. + - Risk: orchestrators and operations tooling cannot reliably detect unhealthy container state. +- `DKL-LI-0003`: unnecessary files detected (`.DS_Store` artifacts in `node_modules` paths). + - Risk: extra artifacts increase image noise and attack surface footprint. + +### Security Posture Assessment + +- **Does the image run as root?** + No. `docker image inspect` reports `User=65532`, so the image defaults to non-root execution. + +- **Recommended security improvements** + - Upgrade/patch vulnerable dependencies (especially `node`, `multer`, `vm2`, OpenSSL layer). + - Add `HEALTHCHECK` to image metadata. + - Enable Docker Content Trust / signed image verification in CI and deployment. + - Rebuild image frequently to absorb base-layer security fixes. + - Gate releases on high/critical vulnerability thresholds. + +## Task 2 — Docker Host Security Benchmarking (CIS) + +Source: `labs/lab7/hardening/docker-bench-results.txt` +ANSI-cleaned copy: `labs/lab7/hardening/docker-bench-results-clean.txt` + +### Summary Statistics + +- `PASS`: **25** +- `WARN`: **15** +- `FAIL`: **0** +- `INFO`: **27** +- `NOTE`: **7** + +Counts above are normalized on control IDs (patterns like `X.Y`) from the cleaned benchmark output, matching the reported `Checks: 74`. +Benchmark-reported score in this run: `10`. + +### Analysis of Failures + +No explicit `[FAIL]` results were reported in this run. + +### Key Warning Analysis and Remediation + +Most important warnings observed: + +1. `1.1` Separate partition for containers not created. + - Impact: disk exhaustion on Docker data can affect host/system partitions. + - Remediation: mount `/var/lib/docker` on dedicated storage. + +2. `1.5`–`1.9` Auditing is not fully configured for Docker daemon/files/service/socket. + - Impact: reduced forensic visibility and weaker incident investigation capability. + - Remediation: enable `auditd` rules for Docker daemon/socket/files. + +3. `2.8` User namespace support not enabled. + - Impact: weaker UID/GID isolation between container and host. + - Remediation: enable `userns-remap` in daemon config. + +4. `2.11` Authorization for Docker client commands not enabled. + - Impact: insufficient policy-based control over daemon actions. + - Remediation: use Docker authorization plugins / RBAC controls. + +5. `2.12` Centralized logging not configured. + - Impact: harder detection/correlation of container abuse across systems. + - Remediation: configure remote log driver/SIEM pipeline. + +6. `2.14` Live restore not enabled. + - Impact: daemon restarts can interrupt container availability. + - Remediation: set `"live-restore": true` in daemon config. + +7. `2.15` Userland proxy not disabled. + - Impact: unnecessary networking surface and performance overhead. + - Remediation: set `"userland-proxy": false` in daemon config. + +8. `2.18` Containers are not globally restricted from acquiring new privileges (daemon default). + - Impact: weaker default posture for containers launched without explicit hardening flags. + - Remediation: enforce `no-new-privileges` through daemon policy or orchestrator baseline. + +9. `4.5` Content trust not enabled. + - Impact: no signature/provenance enforcement for pulled images. + - Remediation: enable Docker Content Trust / image signature verification policy. + +10. `4.6` Missing `HEALTHCHECK` instructions in images (including Juice Shop image). + - Impact: slower detection of unhealthy containers and weaker self-healing behavior. + - Remediation: define container health probes in image/build process. + +## Task 3 — Deployment Security Configuration Analysis + +Source: `labs/lab7/analysis/deployment-comparison.txt` + +### Runtime Comparison (Functionality + Resources) + +- Functionality: + - `Default`: HTTP `200` + - `Hardened`: HTTP `200` + - `Production`: HTTP `200` +- Resource usage snapshot: + - `juice-default`: `108.4MiB / 13.34GiB` (no memory limit) + - `juice-hardened`: `95.78MiB / 512MiB` + - `juice-production`: `97.82MiB / 512MiB` + +### Configuration Comparison Table + +| Setting | Default | Hardened | Production | +|---|---|---|---| +| Capabilities dropped | none | `ALL` | `ALL` | +| Capabilities added | none | none | `NET_BIND_SERVICE` | +| Security options | none | `no-new-privileges` | `no-new-privileges` | +| Memory limit | none (`0`) | `512m` | `512m` | +| Memory swap | none (`0`) | `1g` effective | `512m` (swap disabled) | +| CPU limit | none | `--cpus=1.0` (`NanoCpus=1000000000`) | `--cpus=1.0` (`NanoCpus=1000000000`) | +| PIDs limit | none | none | `100` | +| Restart policy | `no` | `no` | `on-failure:3` | + +Note: `CPUQuota/CPUPeriod` showed `0` in inspect output because this Docker version tracks the configured CPU cap through `NanoCpus` for `--cpus`. +Note: explicit `--security-opt=seccomp=default` failed on this host (`open default: no such file or directory`), so runtime testing used Docker's implicit default seccomp behavior. + +### Security Measure Analysis + +#### a) `--cap-drop=ALL` and `--cap-add=NET_BIND_SERVICE` + +- Linux capabilities split root powers into smaller privileges. +- Dropping all capabilities blocks many privilege-abuse paths (network admin actions, kernel interface abuse, etc.). +- `NET_BIND_SERVICE` is re-added only when binding low ports may be needed. +- Trade-off: least privilege improves security but may break software expecting broader kernel privileges. + +#### b) `--security-opt=no-new-privileges` + +- Prevents processes from gaining extra privileges via `setuid`, `setgid`, or file capabilities. +- Mitigates local privilege escalation chains after initial code execution. +- Downsides: can break legacy programs that depend on privilege elevation behavior. + +#### c) `--memory=512m` and `--cpus=1.0` + +- Without limits, a compromised or buggy container can consume excessive host RAM/CPU and starve neighbors. +- Memory limit helps contain memory exhaustion/DoS impact. +- Limits that are too low can cause OOM kills, throttling, latency spikes, and false health failures. + +#### d) `--pids-limit=100` + +- A fork bomb rapidly creates processes until PID table/resources are exhausted. +- PID limits constrain blast radius and protect host/process scheduler stability. +- Right sizing requires observing normal process count + burst margin under realistic load tests. + +#### e) `--restart=on-failure:3` + +- Restarts container only when it exits non-zero, up to 3 retries. +- Useful for transient crashes and short-lived failures. +- Risk: repeated restart loops can hide root causes and increase noise. +- `on-failure` is safer than `always` for many services because it avoids perpetual restarts even on clean stop scenarios. + +### Critical Thinking Answers + +1. **Best profile for development:** + `Default` or `Hardened` depending on team needs. + - `Default` is simplest for debugging. + - `Hardened` is better for early security parity while still easy to run. + +2. **Best profile for production:** + `Production` due least privilege + resource controls + PID cap + controlled restart behavior. + +3. **Real-world problem solved by resource limits:** + Prevents single-service runaway usage from causing multi-tenant outages (`noisy neighbor` and DoS containment). + +4. **If attacker exploits Default vs Production, what is blocked in Production?** + - Harder privilege escalation (`no-new-privileges`, dropped capabilities). + - Reduced ability to exhaust host resources (memory/CPU/PID caps). + - Narrower post-exploit operating envelope because only minimal privileges remain. + +5. **Additional hardening to add** + - Explicit seccomp profile (default/baseline hardened profile pinned by policy). + - Read-only root filesystem and dedicated `tmpfs` mounts. + - `--user` pinning in runtime policy (even though image already sets non-root user). + - AppArmor/SELinux enforcement profiles. + - Network policies/egress restrictions and runtime IDS. + - Signed images + SBOM attestation + policy gate in CI/CD. + +## Evidence Files + +- `labs/lab7/scanning/scout-cves.txt` +- `labs/lab7/scanning/scout-quickview.txt` +- `labs/lab7/scanning/snyk-results.txt` +- `labs/lab7/scanning/dockle-results.txt` +- `labs/lab7/hardening/docker-bench-results.txt` +- `labs/lab7/hardening/docker-bench-results-clean.txt` +- `labs/lab7/analysis/deployment-comparison.txt`