Update s3.tf by bmppa · Pull Request #11 · bmppa/iac-demo

bmppa · 2023-01-25T09:32:15Z

No description provided.

prisma-cloud-devsecops

Prisma Cloud has found errors in this PR ⬇️

prisma-cloud-devsecops · 2023-01-25T09:33:19Z

-    git_repo             = "iac-demo"
-    yor_trace            = "8cebc6f3-14b0-4a60-bd65-7988a2c206f1"
-  }
 }


Suggested change

}

acl = "private"

AWS S3 bucket ACL grants READ permission to everyone
Resource: aws_s3_bucket.data | Policy ID: 807152304871829504_AWS_1670654004846 | Checkov ID: CKV_AWS_20

Description
https://docs.bridgecrew.io/docs/s3_1-acl-read-permissions-everyone
Benchmarks

NIST-800-53 AC-17

🎉 Fixed by commit ac01ce3 - Prisma Cloud bot fix for terraform/aws/s3.tf

prisma-cloud-devsecops · 2023-01-25T09:33:19Z

-    git_repo             = "iac-demo"
-    yor_trace            = "8cebc6f3-14b0-4a60-bd65-7988a2c206f1"
-  }
 }


AWS Access logging not enabled on S3 buckets
    Resource: aws_s3_bucket.data | Bridgecrew ID: BC_AWS_S3_13 | Checkov ID: CKV_AWS_18

How to Fix

resource "aws_s3_bucket" "bucket" { acl = var.s3_bucket_acl bucket = var.s3_bucket_name policy = var.s3_bucket_policy force_destroy = var.s3_bucket_force_destroy versioning { enabled = var.versioning mfa_delete = var.mfa_delete } + dynamic "logging" { + for_each = var.logging + content { + target_bucket = logging.value["target_bucket"] + target_prefix = "log/${var.s3_bucket_name}" + } + } }

Description
Access logging provides detailed audit logging for all objects and folders in an S3 bucket.
Benchmarks

HIPAA 164.312(B) Audit controls

     🎉 Fixed by commit 6eff6f0 - Update s3.tf

prisma-cloud-devsecops · 2023-01-25T09:33:20Z

-    git_repo             = "iac-demo"
-    yor_trace            = "8cebc6f3-14b0-4a60-bd65-7988a2c206f1"
-  }
 }


Testing Bucket with encryption
    Resource: aws_s3_bucket.data | Bridgecrew ID: cb404a47-3b88-40eb-b6ad-94081e055e6a

     🎉 Fixed by commit 6eff6f0 - Update s3.tf

prisma-cloud-devsecops · 2023-01-25T09:33:20Z

-    git_repo             = "iac-demo"
-    yor_trace            = "8cebc6f3-14b0-4a60-bd65-7988a2c206f1"
-  }
 }


AWS S3 Object Versioning is disabled
    Resource: aws_s3_bucket.data | Bridgecrew ID: 807152304871829504_AWS_1658427621485 | Checkov ID: CKV_AWS_21

Description
https://docs.bridgecrew.io/docs/s3_16-enable-versioning

     🎉 Fixed by commit 6eff6f0 - Update s3.tf

prisma-cloud-devsecops

⚠️ Due to ac01ce3 - Prisma Cloud bot fix for terraform/aws/s3.tf - 1 error was fixed.

Change details

Error ID	Change	Path	Resource
807152304871829504_AWS_1670654004846	Fixed	/terraform/aws/s3.tf	aws_s3_bucket.data

prisma-cloud-devsecops · 2023-03-10T05:05:17Z

+    Privacy   = "public"
+    Proj      = "prisma-cloud-pov"
  }
 }


Suggested change

}

}

resource "aws_s3_bucket_versioning" "public_bucket" {

bucket = aws_s3_bucket.public_bucket.id

versioning_configuration {

status = "Enabled"

}

}

resource "aws_s3_bucket" "destination" {

bucket = aws_s3_bucket.public_bucket.id

versioning_configuration {

status = "Enabled"

}

}

resource "aws_iam_role" "replication" {

name = "aws-iam-role"

assume_role_policy = <<POLICY

{

"Version": "2012-10-17",

"Statement": [

{

"Action": "sts:AssumeRole",

"Principal": {

"Service": "s3.amazonaws.com"

},

"Effect": "Allow",

"Sid": ""

}

]

}

POLICY

}

resource "aws_s3_bucket_replication_configuration" "public_bucket" {

depends_on = [aws_s3_bucket_versioning.public_bucket]

role = aws_iam_role.public_bucket.arn

bucket = aws_s3_bucket.public_bucket.id

rule {

id = "foobar"

status = "Enabled"

destination {

bucket = aws_s3_bucket.destination.arn

storage_class = "STANDARD"

}

}

}

S3 bucket cross-region replication disabled
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: BC_AWS_GENERAL_72 | Checkov ID: CKV_AWS_144

How to Fix

resource "aws_s3_bucket" "test" { ... + replication_configuration { + role = aws_iam_role.replication.arn + rules { + id = "foobar" + prefix = "foo" + status = "Enabled" + + destination { + bucket = aws_s3_bucket.destination.arn + storage_class = "STANDARD" + } + } + } }

Description
Cross-region replication enables automatic, asynchronous copying of objects across S3 buckets. By default, replication supports copying new S3 objects after it is enabled. It is also possible to use replication to copy existing objects and clone them to a different bucket, but in order to do so, you must contact AWS Support.

prisma-cloud-devsecops · 2023-03-10T05:05:18Z

+    Privacy   = "public"
+    Proj      = "prisma-cloud-pov"
  }
 }


Suggested change

}

}

resource "aws_s3_bucket_server_side_encryption_configuration" "public_bucket" {

bucket = aws_s3_bucket.public_bucket.bucket

rule {

apply_server_side_encryption_by_default {

sse_algorithm = "aws:kms"

}

}

}

S3 buckets are not encrypted with KMS
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: BC_AWS_GENERAL_56 | Checkov ID: CKV_AWS_145

How to Fix

resource "aws_s3_bucket" "bucket_name" { bucket = "bucket_good" } + resource "aws_s3_bucket_server_side_encryption_configuration" "good_sse_1" { + bucket = aws_s3_bucket.bucket_name.bucket + + rule { + apply_server_side_encryption_by_default { + kms_master_key_id = aws_kms_key.mykey.arn + sse_algorithm = "aws:kms" + } + } + }

Description
Encrypting your data and resources with KMS helps protect your data from unauthorized access or tampering. By encrypting your data, you can ensure that only authorized users can access and decrypt the data, and that the data is protected while in storage or in transit. Such action can help protect against external threats such as hackers or malware, as well as internal threats such as accidental or unauthorized access.

prisma-cloud-devsecops · 2023-03-10T05:05:50Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


AWS S3 Object Versioning is disabled
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1658427621485 | Checkov ID: CKV_AWS_21

Description
https://docs.bridgecrew.io/docs/s3_16-enable-versioning

prisma-cloud-devsecops · 2023-03-10T05:05:51Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


everitt-build-1
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1678303513602

prisma-cloud-devsecops · 2023-03-10T05:05:52Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


S3 Bucket does not have public access blocks
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: BC_AWS_NETWORKING_52 | Checkov ID: CKV2_AWS_6

How to Fix

resource "aws_s3_bucket" "bucket_good_1" { bucket = "bucket_good" } resource "aws_s3_bucket_public_access_block" "access_good_1" { bucket = aws_s3_bucket.bucket_good_1.id block_public_acls = true block_public_policy = true }

Description
When you create an S3 bucket, it is good practice to set the additional resource **aws_s3_bucket_public_access_block** to ensure the bucket is never accidentally public.
We recommend you ensure S3 bucket has public access blocks. If the public access block is not attached it defaults to False.

prisma-cloud-devsecops · 2023-03-10T05:05:53Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


test_pccs_rule1-EVERITT
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1658067543241

prisma-cloud-devsecops · 2023-03-10T05:05:57Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


Weib - Check for classified S3 bucket without server-side encryption enabled
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1659266345263

prisma-cloud-devsecops · 2023-03-10T05:05:58Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


All S3 Buckets must have a tag with key Classification and have versioning enabled
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1643813941482

Description
Ensure that S3 bucket have a classification tag

prisma-cloud-devsecops · 2023-03-10T05:05:59Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


Testing Bucket with encryption
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: cb404a47-3b88-40eb-b6ad-94081e055e6a

prisma-cloud-devsecops · 2023-03-10T05:06:01Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


Jety_Policy_S3 Tag
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1658067543253

prisma-cloud-devsecops · 2023-03-10T05:06:02Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


VSCode Check
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1651820063408

prisma-cloud-devsecops · 2023-03-10T05:06:06Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


DM_TEST_tags
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1678109938201

Description
test

prisma-cloud-devsecops · 2023-03-10T05:06:07Z

+}
+
+# Create a random string
+resource "random_string" "random" {


DM_TEST_tags
Resource: random_string.random | Bridgecrew ID: 807152304871829504_AWS_1678109938201

Description
test

prisma-cloud-devsecops · 2023-03-10T05:06:11Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


SM test - build policy
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1656555386808

Description
Enable versioning

prisma-cloud-devsecops · 2023-03-10T05:06:12Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


test_pccs_rule1-EVERITT
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1658067543241

prisma-cloud-devsecops · 2023-03-10T05:06:13Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


SM test - build policy
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1656555386808

Description
Enable versioning

prisma-cloud-devsecops · 2023-03-10T05:06:16Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


Testing Bucket with encryption
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: cb404a47-3b88-40eb-b6ad-94081e055e6a

prisma-cloud-devsecops · 2023-03-10T05:06:17Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


DM_TEST_tags
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1678109938201

Description
test

prisma-cloud-devsecops · 2023-03-10T05:06:18Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


Jety_Policy_S3 Tag
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1658067543253

prisma-cloud-devsecops · 2023-03-10T05:06:19Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


VSCode Check
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1651820063408

prisma-cloud-devsecops · 2023-03-10T05:06:21Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


Weib - Check for classified S3 bucket without server-side encryption enabled
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1659266345263

prisma-cloud-devsecops · 2023-03-10T05:06:22Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


AWS S3 Object Versioning is disabled
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1658427621485 | Checkov ID: CKV_AWS_21

Description
https://docs.bridgecrew.io/docs/s3_16-enable-versioning

prisma-cloud-devsecops · 2023-03-10T05:06:23Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


everitt-build-1
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1678303513602

prisma-cloud-devsecops · 2023-03-10T05:06:24Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


All S3 Buckets must have a tag with key Classification and have versioning enabled
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: 807152304871829504_AWS_1643813941482

Description
Ensure that S3 bucket have a classification tag

prisma-cloud-devsecops · 2023-03-10T05:06:25Z

-  acl           = "public-read"
-  force_destroy = true
+# Create a bucket where objects can be public
+resource "aws_s3_bucket" "public_bucket" {


S3 Bucket does not have public access blocks
Resource: aws_s3_bucket.public_bucket | Bridgecrew ID: BC_AWS_NETWORKING_52 | Checkov ID: CKV2_AWS_6

How to Fix

resource "aws_s3_bucket" "bucket_good_1" { bucket = "bucket_good" } resource "aws_s3_bucket_public_access_block" "access_good_1" { bucket = aws_s3_bucket.bucket_good_1.id block_public_acls = true block_public_policy = true }

Description
When you create an S3 bucket, it is good practice to set the additional resource **aws_s3_bucket_public_access_block** to ensure the bucket is never accidentally public.
We recommend you ensure S3 bucket has public access blocks. If the public access block is not attached it defaults to False.

Update s3.tf

e671871

prisma-cloud-devsecops Bot reviewed Jan 25, 2023

View reviewed changes

Prisma Cloud bot fix for terraform/aws/s3.tf

ac01ce3

prisma-cloud-devsecops Bot reviewed Jan 25, 2023

View reviewed changes

bralmeidapan and others added 10 commits March 8, 2023 10:43

updated terraform resources

91a147e

updated terraform resources

804018f

fixed S3 block

cc905a6

Update yor.yml

909b3cb

Update tags (by Yor)

a265595

Update s3.tf

6eff6f0

Update tags (by Yor)

4949b95

Delete s3.tf

6cd0186

Create s3.tf

1670341

Update tags (by Yor)

c10a4e0

prisma-cloud-devsecops Bot reviewed Mar 10, 2023

View reviewed changes

github-actions Bot and others added 4 commits July 31, 2023 16:49

Update tags (by Yor)

b1b0b67

Update s3.tf

15c1849

Updated Checkout Action

a1ec3d0

Update pccs.yaml

f7a3476

-}
+}
+resource "aws_s3_bucket_versioning" "public_bucket" {
+  bucket = aws_s3_bucket.public_bucket.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+resource "aws_s3_bucket" "destination" {
+  bucket = aws_s3_bucket.public_bucket.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+resource "aws_iam_role" "replication" {
+  name = "aws-iam-role"
+  assume_role_policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "s3.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+POLICY
+}
+resource "aws_s3_bucket_replication_configuration" "public_bucket" {
+  depends_on = [aws_s3_bucket_versioning.public_bucket]
+  role   = aws_iam_role.public_bucket.arn
+  bucket = aws_s3_bucket.public_bucket.id
+  rule {
+    id = "foobar"
+    status = "Enabled"
+    destination {
+      bucket        = aws_s3_bucket.destination.arn
+      storage_class = "STANDARD"
+    }
+  }
+}

-}
+}
+resource "aws_s3_bucket_server_side_encryption_configuration" "public_bucket" {
+  bucket = aws_s3_bucket.public_bucket.bucket
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = "aws:kms"
+    }
+  }
+}

Conversation

bmppa commented Jan 25, 2023

Uh oh!

prisma-cloud-devsecops Bot left a comment

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Jan 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Description

Benchmarks

Uh oh!

prisma-cloud-devsecops Bot Jan 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

How to Fix

Description

Benchmarks

Uh oh!

prisma-cloud-devsecops Bot Jan 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Jan 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Description

Uh oh!

prisma-cloud-devsecops Bot left a comment

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

How to Fix

Description

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

How to Fix

Description

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Description

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

How to Fix

Description

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Description

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

Description

Uh oh!

prisma-cloud-devsecops Bot Mar 10, 2023

Choose a reason for hiding this comment

prisma-cloud-devsecops Bot Jan 25, 2023 •

edited

Loading

prisma-cloud-devsecops Bot Jan 25, 2023 •

edited

Loading

prisma-cloud-devsecops Bot Jan 25, 2023 •

edited

Loading

prisma-cloud-devsecops Bot Jan 25, 2023 •

edited

Loading

prisma-cloud-devsecops Bot Mar 10, 2023 •

edited

Loading

prisma-cloud-devsecops Bot Mar 10, 2023 •

edited

Loading