Cd 334

[theprashantyadav]

No description provided.

[clouddrove-ci]

Terraform Security Scan Failed

Show Output

Result #1 HIGH No public access block so not ignoring public acls 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-ignore-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable ignoring the application of public ACLs in PUT calls

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/ignore-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #2 HIGH No public access block so not restricting public buckets 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-no-public-buckets
      Impact Public buckets can be accessed by anyone
  Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/no-public-buckets/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡
────────────────────────────────────────────────────────────────────────────────


Result #3 MEDIUM Bucket does not have logging enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-logging
      Impact There is no way to determine the access to this bucket
  Resolution Add a logging block to the resource to enable access logging

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-logging/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
────────────────────────────────────────────────────────────────────────────────


Result #4 MEDIUM Bucket does not have versioning enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-versioning
      Impact Deleted or modified data would not be recoverable
  Resolution Enable versioning to protect against accidental/malicious removal or modification

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-versioning/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning
────────────────────────────────────────────────────────────────────────────────


Result #5 MEDIUM Password policy allows a maximum password age of greater than 90 days. 
────────────────────────────────────────────────────────────────────────────────
  modules/iam/main.tf:28
   via main.tf:229-251 (module.aws-iam-baseline)
────────────────────────────────────────────────────────────────────────────────
   19    resource "aws_iam_account_password_policy" "default" {
   20      count                          = var.aws_iam_account_password_policy ? 1 : 0
   21      minimum_password_length        = var.minimum_password_length
   22      password_reuse_prevention      = var.password_reuse_prevention
   23      require_lowercase_characters   = var.require_lowercase_characters
   24      require_numbers                = var.require_numbers
   25      require_uppercase_characters   = var.require_uppercase_characters
   26      require_symbols                = var.require_symbols
   27      allow_users_to_change_password = var.allow_users_to_change_password
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-set-max-password-age
      Impact Long life password increase the likelihood of a password eventually being compromised
  Resolution Limit the password duration with an expiry in the policy

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/set-max-password-age/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy
────────────────────────────────────────────────────────────────────────────────


Result #6 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  modules/cloudtrail/main.tf:135-140
   via main.tf:5-30 (module.cloudtrail)
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_cloudwatch_log_group" "cloudtrail_events" {
  136      count             = var.enabled ? 1 : 0
  137      name              = var.cloudwatch_logs_group_name
  138      retention_in_days = var.cloudwatch_logs_retention_in_days
  139      tags              = module.labels.tags
  140    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


Result #7 LOW Bucket does not have a corresponding public access block. 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-specify-public-access-block
      Impact Public access policies may be applied to sensitive data buckets
  Resolution Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/specify-public-access-block/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#bucket
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             1.024718ms
  parsing              616.741567ms
  adaptation           2.393135ms
  checks               13.266695ms
  total                633.426115ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    11
  blocks processed     507
  files read           41

  results
  ──────────────────────────────────────────
  passed               13
  ignored              4
  critical             0
  high                 2
  medium               3
  low                  2

  13 passed, 4 ignored, 7 potential problem(s) detected.

[clouddrove-ci]

Terraform Security Scan Failed

Show Output

Result #1 HIGH No public access block so not ignoring public acls 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-ignore-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable ignoring the application of public ACLs in PUT calls

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/ignore-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #2 HIGH No public access block so not restricting public buckets 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-no-public-buckets
      Impact Public buckets can be accessed by anyone
  Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/no-public-buckets/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡
────────────────────────────────────────────────────────────────────────────────


Result #3 MEDIUM Bucket does not have logging enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-logging
      Impact There is no way to determine the access to this bucket
  Resolution Add a logging block to the resource to enable access logging

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-logging/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
────────────────────────────────────────────────────────────────────────────────


Result #4 MEDIUM Bucket does not have versioning enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-versioning
      Impact Deleted or modified data would not be recoverable
  Resolution Enable versioning to protect against accidental/malicious removal or modification

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-versioning/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning
────────────────────────────────────────────────────────────────────────────────


Result #5 MEDIUM Password policy allows a maximum password age of greater than 90 days. 
────────────────────────────────────────────────────────────────────────────────
  modules/iam/main.tf:28
   via main.tf:229-251 (module.aws-iam-baseline)
────────────────────────────────────────────────────────────────────────────────
   19    resource "aws_iam_account_password_policy" "default" {
   20      count                          = var.aws_iam_account_password_policy ? 1 : 0
   21      minimum_password_length        = var.minimum_password_length
   22      password_reuse_prevention      = var.password_reuse_prevention
   23      require_lowercase_characters   = var.require_lowercase_characters
   24      require_numbers                = var.require_numbers
   25      require_uppercase_characters   = var.require_uppercase_characters
   26      require_symbols                = var.require_symbols
   27      allow_users_to_change_password = var.allow_users_to_change_password
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-set-max-password-age
      Impact Long life password increase the likelihood of a password eventually being compromised
  Resolution Limit the password duration with an expiry in the policy

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/set-max-password-age/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy
────────────────────────────────────────────────────────────────────────────────


Result #6 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  modules/cloudtrail/main.tf:135-140
   via main.tf:5-30 (module.cloudtrail)
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_cloudwatch_log_group" "cloudtrail_events" {
  136      count             = var.enabled ? 1 : 0
  137      name              = var.cloudwatch_logs_group_name
  138      retention_in_days = var.cloudwatch_logs_retention_in_days
  139      tags              = module.labels.tags
  140    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


Result #7 LOW Bucket does not have a corresponding public access block. 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-specify-public-access-block
      Impact Public access policies may be applied to sensitive data buckets
  Resolution Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/specify-public-access-block/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#bucket
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             998.2µs
  parsing              1.892177815s
  adaptation           1.8186ms
  checks               13.901702ms
  total                1.908896317s

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    11
  blocks processed     507
  files read           41

  results
  ──────────────────────────────────────────
  passed               13
  ignored              4
  critical             0
  high                 2
  medium               3
  low                  2

  13 passed, 4 ignored, 7 potential problem(s) detected.

[clouddrove-ci]

Terraform Security Scan Failed

Show Output

Result #1 HIGH No public access block so not ignoring public acls 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-ignore-public-acls
      Impact PUT calls with public ACLs specified can make objects public
  Resolution Enable ignoring the application of public ACLs in PUT calls

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/ignore-public-acls/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#ignore_public_acls
────────────────────────────────────────────────────────────────────────────────


Result #2 HIGH No public access block so not restricting public buckets 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-no-public-buckets
      Impact Public buckets can be accessed by anyone
  Resolution Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/no-public-buckets/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#restrict_public_buckets¡
────────────────────────────────────────────────────────────────────────────────


Result #3 MEDIUM Bucket does not have logging enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-bucket-logging
      Impact There is no way to determine the access to this bucket
  Resolution Add a logging block to the resource to enable access logging

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-bucket-logging/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket
────────────────────────────────────────────────────────────────────────────────


Result #4 MEDIUM Bucket does not have versioning enabled 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-enable-versioning
      Impact Deleted or modified data would not be recoverable
  Resolution Enable versioning to protect against accidental/malicious removal or modification

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/enable-versioning/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning
────────────────────────────────────────────────────────────────────────────────


Result #5 MEDIUM Password policy allows a maximum password age of greater than 90 days. 
────────────────────────────────────────────────────────────────────────────────
  modules/iam/main.tf:28
   via main.tf:229-251 (module.aws-iam-baseline)
────────────────────────────────────────────────────────────────────────────────
   19    resource "aws_iam_account_password_policy" "default" {
   20      count                          = var.aws_iam_account_password_policy ? 1 : 0
   21      minimum_password_length        = var.minimum_password_length
   22      password_reuse_prevention      = var.password_reuse_prevention
   23      require_lowercase_characters   = var.require_lowercase_characters
   24      require_numbers                = var.require_numbers
   25      require_uppercase_characters   = var.require_uppercase_characters
   26      require_symbols                = var.require_symbols
   27      allow_users_to_change_password = var.allow_users_to_change_password
   ..  
────────────────────────────────────────────────────────────────────────────────
          ID aws-iam-set-max-password-age
      Impact Long life password increase the likelihood of a password eventually being compromised
  Resolution Limit the password duration with an expiry in the policy

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/iam/set-max-password-age/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_account_password_policy
────────────────────────────────────────────────────────────────────────────────


Result #6 LOW Log group is not encrypted. 
────────────────────────────────────────────────────────────────────────────────
  modules/cloudtrail/main.tf:135-140
   via main.tf:5-30 (module.cloudtrail)
────────────────────────────────────────────────────────────────────────────────
  135    resource "aws_cloudwatch_log_group" "cloudtrail_events" {
  136      count             = var.enabled ? 1 : 0
  137      name              = var.cloudwatch_logs_group_name
  138      retention_in_days = var.cloudwatch_logs_retention_in_days
  139      tags              = module.labels.tags
  140    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-cloudwatch-log-group-customer-key
      Impact Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
  Resolution Enable CMK encryption of CloudWatch Log Groups

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/cloudwatch/log-group-customer-key/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id
────────────────────────────────────────────────────────────────────────────────


Result #7 LOW Bucket does not have a corresponding public access block. 
────────────────────────────────────────────────────────────────────────────────
  modules/guardduty/main.tf:22-26
   via main.tf:116-138 (module.guardduty)
────────────────────────────────────────────────────────────────────────────────
   22    resource "aws_s3_bucket" "bucket" {
   23      count         = var.enabled ? 1 : 0
   24      bucket        = var.bucket_name
   25      force_destroy = true
   26    }
────────────────────────────────────────────────────────────────────────────────
          ID aws-s3-specify-public-access-block
      Impact Public access policies may be applied to sensitive data buckets
  Resolution Define a aws_s3_bucket_public_access_block for the given bucket to control public access policies

  More Information
  - https://aquasecurity.github.io/tfsec/latest/checks/aws/s3/specify-public-access-block/
  - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block#bucket
────────────────────────────────────────────────────────────────────────────────


  timings
  ──────────────────────────────────────────
  disk i/o             1.084308ms
  parsing              644.895114ms
  adaptation           2.503125ms
  checks               20.118903ms
  total                668.60145ms

  counts
  ──────────────────────────────────────────
  modules downloaded   0
  modules processed    11
  blocks processed     507
  files read           41

  results
  ──────────────────────────────────────────
  passed               13
  ignored              4
  critical             0
  high                 2
  medium               3
  low                  2

  13 passed, 4 ignored, 7 potential problem(s) detected.

[yadavprakash]

LGTM!