Pr test 123

[try-panwiac]

No description provided.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

  Security Groups are not attached to EC2 instances or ENIs
    Resource: aws_security_group.example | Bridgecrew ID: 806079772773363712_AWS_1666217148788 | Checkov ID: CKV2_AWS_5

Description

https://docs.bridgecrew.io/docs/ensure-that-security-groups-are-attached-to-ec2-instances-or-elastic-network-interfaces-enis

[prisma-cloud-devsecops]

  AWS Security Group allows all traffic on RDP port (3389)
    Resource: aws_security_group.example | Bridgecrew ID: 806079772773363712_AWS_1681373481825 | Checkov ID: CKV_AWS_25

Description

https://docs.bridgecrew.io/docs/networking_2

Benchmarks

• SOC2 CC6.3.3
• PCI-DSS V3.2 2
• HIPAA 164.312(E)(1)
• NIST-800-53 AC-17, CA-3, CA-9, CM-3, SC-2
• ISO27001 A.10.1.1
• CIS AWS V1.2 4.2
• PCI-DSS V3.2.1 1.2.1, 1.3
• FEDRAMP (MODERATE) AC-4, CM-2, SC-7, SC-7(3)
• CIS AWS V1.3 5.2

[prisma-cloud-devsecops]

  AWS resources that support tags do not have Tags
    Resource: aws_security_group.example | Bridgecrew ID: BC_AWS_GENERAL_26 | Checkov ID: CKV_AWS_CUSTOM_1

How to Fix

resource "aws_security_group" "sg" {
  name = "my-sg"
  ...
+ tags = {
+   Environment = "dev"
+   Owner = "apps-team"
+ }
}

Description

Many different types of AWS resources support tags. Tags allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that tags can be used, we recommend you follow a tagging practice.

View AWS's recommended tagging best practices here.

[prisma-cloud-devsecops]

  Not every Security Group rule has a description
    Resource: aws_security_group.example | Bridgecrew ID: BC_AWS_NETWORKING_31 | Checkov ID: CKV_AWS_23

How to Fix

resource "aws_security_group" "examplea" {
  name        = var.es_domain
  description = "Allow inbound traffic to ElasticSearch from VPC CIDR"
  vpc_id      = var.vpc


  ingress {
    cidr_blocks = ["10.0.0.0/16"]
   + description = "What does this rule enable"
    from_port   = 80
    protocol    = "tcp"
    to_port     = 80
  }
}

Description

Descriptions can be up to 255 characters long and can be set and viewed from the AWS Management Console, AWS Command Line Interface (CLI), and the AWS APIs.

We recommend you add descriptive text to each of your Security Group Rules clarifying each rule's goals, this helps prevent developer errors.

Benchmarks

• SOC2 CC6.3.3
• ISO27001 A.10.1.1