Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add files via upload #57

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add files via upload #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 6 additions & 17 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,7 @@
FROM node:12-alpine
ENV WORKDIR /usr/src/app/
WORKDIR $WORKDIR
COPY package*.json $WORKDIR
RUN npm install --production --no-cache
FROM node
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  Base image uses a latest version tag
    Resource: /Dockerfile.FROM | Bridgecrew ID: BC_DKR_7 | Checkov ID: CKV_DOCKER_7

Description

When possible, it is recommended to pin the version for the base image in your Dockerfiles. There are a number of potential issues that may be caused when using the `latest` tag. Since `latest` is the default tag when a tag is not specified, it does not automatically refer to the latest version of the image. This can lead to the use of outdated images and in the case of production deployments, using a dynamic version can cause unexpected behavior and difficulty in determining which version is being currently used. It is best practice to be specific as possible about what is running to make operations predictable and reliable

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  Healthcheck instructions have not been added to container images
    Resource: /Dockerfile. | Bridgecrew ID: BC_DKR_2 | Checkov ID: CKV_DOCKER_2

Description

We recommend that you add the HEALTHCHECK instruction to your Docker container images to ensure that health checks are executed against running containers.

An important security control is that of availability. Adding the HEALTHCHECK instruction to your container image ensures that the Docker engine periodically checks the running container instances against that instruction to ensure that containers are still operational.

Based on the results of the health check, the Docker engine could terminate containers which are not responding correctly, and instantiate new ones.

Benchmarks

  • CIS DOCKER V1.2 4.6

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  A user for the container has not been created
    Resource: /Dockerfile. | Bridgecrew ID: BC_DKR_3 | Checkov ID: CKV_DOCKER_3

Description

Containers should run as a non-root user. It is good practice to run the container as a non-root user, where possible. This can be done either via the ```USER``` directive in the ```Dockerfile``` or through ```gosu``` or similar where used as part of the ```CMD``` or ```ENTRYPOINT``` directives.

Benchmarks

  • CIS DOCKER V1.2 4.1


FROM node:12-alpine
ENV USER node
ENV WORKDIR /home/$USER/app
WORKDIR $WORKDIR
COPY --from=0 /usr/src/app/node_modules node_modules
RUN chown $USER:$USER $WORKDIR
COPY --chown=node . $WORKDIR
# In production environment uncomment the next line
#RUN chown -R $USER:$USER /home/$USER && chmod -R g-s,o-rx /home/$USER && chmod -R o-wrx $WORKDIR
# Then all further actions including running the containers should be done under non-root user.
USER $USER
EXPOSE 4000
COPY . /

RUN npm install

CMD "npm" "start"
114 changes: 28 additions & 86 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,94 +1,36 @@
resource "aws_s3_bucket" "data" {
# bucket is public
# bucket is not encrypted
# bucket does not have access logs
# bucket does not have versioning
bucket = "${local.resource_prefix.value}-data"
region = "us-west-2"
acl = "public-read"
#force_destroy = true
tags = {
Name = "${local.resource_prefix.value}-data"
Environment = local.resource_prefix.value
}
provider "aws" {
region = "us-east-1"
}

resource "aws_s3_bucket_object" "data_object" {
bucket = aws_s3_bucket.data.id
region = "us-west-2"
key = "customer-master.xlsx"
source = "resources/customer-master.xlsx"
tags = {
Name = "${local.resource_prefix.value}-customer-master"
Environment = local.resource_prefix.value
}
resource "aws_lambda_function" "example_lambda" {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  AWS resources that support tags do not have Tags
    Resource: aws_lambda_function.example_lambda | Bridgecrew ID: BC_AWS_GENERAL_26 | Checkov ID: CKV_AWS_CUSTOM_1

How to Fix

resource "aws_security_group" "sg" {
  name = "my-sg"
  ...
+ tags = {
+   Environment = "dev"
+   Owner = "apps-team"
+ }
}

Description

Many different types of AWS resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.

View AWS's recommended tagging best practices here.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  AWS Lambda Function is not assigned to access within VPC
    Resource: aws_lambda_function.example_lambda | Bridgecrew ID: BC_AWS_GENERAL_65 | Checkov ID: CKV_AWS_117

How to Fix

resource "aws_lambda_function" "test_lambda" {
  ...
  vpc_config {
    // Every subnet should be able to reach an EFS mount target in the same Availability Zone. 
    // Cross-AZ mounts are not permitted.
+   subnet_ids         = [aws_subnet.subnet_for_lambda.id]
    security_group_ids = [aws_security_group.sg_for_lambda.id]
  }
}

Description

By default, Lambda runs functions in a secure VPC with access to AWS services and the internet. Lambda owns this VPC, which isn't connected to the account's default VPC. Internet access from a private subnet requires Network Address Translation (NAT).

To give your function access to the internet, route outbound traffic to a NAT gateway in a public subnet.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  AWS Lambda function is not configured for function-level concurrent execution Limit
    Resource: aws_lambda_function.example_lambda | Bridgecrew ID: BC_AWS_GENERAL_63 | Checkov ID: CKV_AWS_115

How to Fix

resource "aws_lambda_function" "example" {
   ...
+  reserved_concurrent_executions = 100
}

Description

Adding concurrency to Lambda initializes that number of execution environments for multiple parallel requests at low latency. However, this could spike costs and open the door for abuse. Adding concurrency limits can prevent a rapid spike in usage and costs, while also increasing or lowering the default concurrency limit.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  AWS Lambda function is not configured for a DLQ
    Resource: aws_lambda_function.example_lambda | Bridgecrew ID: BC_AWS_GENERAL_64 | Checkov ID: CKV_AWS_116

How to Fix

resource "aws_lambda_function" "test_lambda" {
  ...   
+ dead_letter_config {
+   target_arn = "test"
+ }
}

Description

Setting up a DLQ offers the possibility to investigate errors or failed requests to the connected Lambda function.

As an alternative it is possible to configure an on-failure destination target, which forwards a failed event to a DLQ, SNS Topic, Lambda function or EventBridge.

It is always important to understand why your application/function failed and to ensure that no data was dropped or compromised. Lambda functions are often used to process security related data like CloudTrail events and a failed delivery to a dependent system can result in an unnoticed security breach.

function_name = "example_lambda_function"
handler = "index.handler"
runtime = "provided.al2"
role = aws_iam_role.lambda_exec.arn
timeout = 15
memory_size = 256
package_type = "Image"
image_uri = "node"
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
}
tracing_config {
mode = "PassThrough"
}
}
LOW  AWS Lambda functions with tracing not enabled
    Resource: aws_lambda_function.example_lambda | Bridgecrew ID: BC_AWS_SERVERLESS_4 | Checkov ID: CKV_AWS_50

How to Fix

tracing_config {
  mode = "Active"
}

Description

X-Ray tracing in lambda functions allows you to visualize and troubleshoot errors and performance bottlenecks, and investigate requests that resulted in an error.


resource "aws_s3_bucket" "financials" {
# bucket is not encrypted
# bucket does not have access logs
# bucket does not have versioning
bucket = "${local.resource_prefix.value}-financials"
region = "us-west-2"
acl = "public-read"
force_destroy = true
tags = {
Name = "${local.resource_prefix.value}-financials"
Environment = local.resource_prefix.value
}
resource "aws_iam_role" "lambda_exec" {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW  AWS resources that support tags do not have Tags
    Resource: aws_iam_role.lambda_exec | Bridgecrew ID: BC_AWS_GENERAL_26 | Checkov ID: CKV_AWS_CUSTOM_1

How to Fix

resource "aws_security_group" "sg" {
  name = "my-sg"
  ...
+ tags = {
+   Environment = "dev"
+   Owner = "apps-team"
+ }
}

Description

Many different types of AWS resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.

View AWS's recommended tagging best practices here.

name = "example-lambda-exec"

assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "lambda.amazonaws.com"
}
}
]
})
}

resource "aws_s3_bucket" "operations" {
# bucket is not encrypted
# bucket does not have access logs
bucket = "${local.resource_prefix.value}-operations"
region = "us-west-2"
acl = "private"
versioning {
enabled = true
}
force_destroy = true
tags = {
Name = "${local.resource_prefix.value}-operations"
Environment = local.resource_prefix.value
}

}

resource "aws_s3_bucket" "data_science" {
# bucket is not encrypted
bucket = "${local.resource_prefix.value}-data-science"
region = "us-west-2"
acl = "private"
versioning {
enabled = true
}
logging {
target_bucket = "${aws_s3_bucket.logs.id}"
target_prefix = "log/"
}
force_destroy = true
}

resource "aws_s3_bucket" "logs" {
bucket = "${local.resource_prefix.value}-logs"
region = "us-west-2"
acl = "log-delivery-write"
versioning {
enabled = true
}
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
kms_master_key_id = "${aws_kms_key.logs_key.arn}"
}
}
}
force_destroy = true
tags = {
Name = "${local.resource_prefix.value}-logs"
Environment = local.resource_prefix.value
}
resource "aws_iam_role_policy_attachment" "lambda_exec_attachment" {
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
role = aws_iam_role.lambda_exec.name
}
Loading