IaC Security

# .gitlab-ci.yml - DevSecOps Pipeline for Terraform stages: - init - test - plan - deploy variables: TF_ROOT: ${CI_PROJECT_DIR}/terraform # Terraform initialization init: stage: init image: hashicorp/terraform:1.6 script: - cd $TF_ROOT - terraform init -backend-config="bucket=$TF_STATE_BUCKET" artifacts: paths: - $TF_ROOT/.terraform # Syntax validation validate: stage: test image: hashicorp/terraform:1.6 script: - cd $TF_ROOT - terraform validate allow_failure: false # Security scanning with tfsec tfsec: stage: test image: aquasec/tfsec:latest script: - tfsec $TF_ROOT --format json --out tfsec-results.json artifacts: paths: - tfsec-results.json when: always allow_failure: true # Does not block pipeline, but reports issues # Security scanning with Checkov checkov: stage: test image: bridgecrew/checkov:latest script: - checkov -d $TF_ROOT --output-file checkov-results.json --output json artifacts: paths: - checkov-results.json when: always allow_failure: true # Terraform plan plan: stage: plan image: hashicorp/terraform:1.6 script: - cd $TF_ROOT - terraform plan -out=tfplan artifacts: paths: - $TF_ROOT/tfplan dependencies: - init # Terraform apply - only on main branch with manual approval deploy: stage: deploy image: hashicorp/terraform:1.6 script: - cd $TF_ROOT - terraform apply -auto-approve tfplan dependencies: - plan when: manual only: - main environment: name: production

# tfsec results Result #1 CRITICAL Security group rule allows ingress from public internet Location: main.tf:173 Description: Opening a security group to the public internet allows any IP address to potentially access resources behind the security group. Impact: Resources could be exposed to the public internet Resolution: Limit the CIDR blocks to known IP ranges See https://aquasecurity.github.io/tfsec/latest/checks/aws/vpc/... --- Result #2 HIGH VPC Flow Logs is not enabled Location: main.tf:45 Description: VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC. Resolution: Enable VPC Flow Logs for audit and troubleshooting --- 8 potential problems detected (17 passed)

# WRONG - overly open security group resource "aws_security_group" "bad_example" { name = "allow-all" ingress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] # All ports open to the world! } } # RIGHT - minimum required permissions resource "aws_security_group" "good_example" { name = "app-security-group" description = "Security group for web application" vpc_id = aws_vpc.main.id # HTTPS only ingress { description = "HTTPS from internet" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } # Only necessary egress egress { description = "HTTPS outbound" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "app-sg" Environment = var.environment } }

# Secure S3 bucket resource "aws_s3_bucket" "secure_bucket" { bucket = "my-secure-bucket-${var.environment}" tags = { Name = "secure-bucket" Environment = var.environment } } # Block public access resource "aws_s3_bucket_public_access_block" "secure_bucket" { bucket = aws_s3_bucket.secure_bucket.id block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } # Enable encryption resource "aws_s3_bucket_server_side_encryption_configuration" "secure_bucket" { bucket = aws_s3_bucket.secure_bucket.id rule { apply_server_side_encryption_by_default { sse_algorithm = "aws:kms" kms_master_key_id = aws_kms_key.s3_key.arn } bucket_key_enabled = true } } # Enable versioning resource "aws_s3_bucket_versioning" "secure_bucket" { bucket = aws_s3_bucket.secure_bucket.id versioning_configuration { status = "Enabled" } } # Access logging resource "aws_s3_bucket_logging" "secure_bucket" { bucket = aws_s3_bucket.secure_bucket.id target_bucket = aws_s3_bucket.log_bucket.id target_prefix = "s3-access-logs/" }