terragoat v0.6 releases: Vulnerable Terraform Infrastructure
TerraGoat – Vulnerable Terraform Infrastructure
TerraGoat is Bridgecrew’s “Vulnerable by Design” Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.
TerraGoat was built to enable DevSecOps to design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like Checkov, inline-linters, pre-commit hooks, or other code scanning methods.
TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure.
Existing vulnerabilities (Auto-Generated)
| check_id | file | resource | check_name | |
|---|---|---|---|---|
| 0 | CKV_AWS_46 | /ec2.tf | aws_instance.web_host | Ensure no hardcoded AWS access key and secret key exists in EC2 user data |
| 1 | CKV_AWS_8 | /ec2.tf | aws_instance.web_host | Ensure all data stored in the Launch configuration EBS is securely encrypted |
| 2 | CKV_AWS_3 | /ec2.tf | aws_ebs_volume.web_host_storage | Ensure all data stored in the EBS is securely encrypted |
| 3 | CKV_AWS_4 | /ec2.tf | aws_ebs_snapshot.example_snapshot | Ensure all data stored in the EBS Snapshot is securely encrypted |
| 4 | CKV_AWS_24 | /ec2.tf | aws_security_group.web-node | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 |
| 5 | CKV_AWS_21 | /ec2.tf | aws_s3_bucket.flowbucket | Ensure all data stored in the S3 bucket have versioning enabled |
| 6 | CKV_AWS_52 | /ec2.tf | aws_s3_bucket.flowbucket | Ensure S3 bucket has MFA delete enabled |
| 7 | CKV_AWS_19 | /ec2.tf | aws_s3_bucket.flowbucket | Ensure all data stored in the S3 bucket is securely encrypted at rest |
| 8 | CKV_AWS_18 | /ec2.tf | aws_s3_bucket.flowbucket | Ensure the S3 bucket has access logging enabled |
| 9 | CKV_AWS_21 | /s3.tf | aws_s3_bucket.data | Ensure all data stored in the S3 bucket have versioning enabled |
| 10 | CKV_AWS_52 | /s3.tf | aws_s3_bucket.data | Ensure S3 bucket has MFA delete enabled |
| 11 | CKV_AWS_19 | /s3.tf | aws_s3_bucket.data | Ensure all data stored in the S3 bucket is securely encrypted at rest |
| 12 | CKV_AWS_20 | /s3.tf | aws_s3_bucket.data | S3 Bucket has an ACL defined which allows public READ access. |
| 13 | CKV_AWS_18 | /s3.tf | aws_s3_bucket.data | Ensure the S3 bucket has access logging enabled |
| 14 | CKV_AWS_21 | /s3.tf | aws_s3_bucket.financials | Ensure all data stored in the S3 bucket have versioning enabled |
| 15 | CKV_AWS_52 | /s3.tf | aws_s3_bucket.financials | Ensure S3 bucket has MFA delete enabled |
| 16 | CKV_AWS_19 | /s3.tf | aws_s3_bucket.financials | Ensure all data stored in the S3 bucket is securely encrypted at rest |
| 17 | CKV_AWS_18 | /s3.tf | aws_s3_bucket.financials | Ensure the S3 bucket has access logging enabled |
| 18 | CKV_AWS_52 | /s3.tf | aws_s3_bucket.operations | Ensure S3 bucket has MFA delete enabled |
| 19 | CKV_AWS_19 | /s3.tf | aws_s3_bucket.operations | Ensure all data stored in the S3 bucket is securely encrypted at rest |
| 20 | CKV_AWS_18 | /s3.tf | aws_s3_bucket.operations | Ensure the S3 bucket has access logging enabled |
| 21 | CKV_AWS_52 | /s3.tf | aws_s3_bucket.data_science | Ensure S3 bucket has MFA delete enabled |
| 22 | CKV_AWS_19 | /s3.tf | aws_s3_bucket.data_science | Ensure all data stored in the S3 bucket is securely encrypted at rest |
| 23 | CKV_AWS_52 | /s3.tf | aws_s3_bucket.logs | Ensure S3 bucket has MFA delete enabled |
| 24 | CKV_AWS_18 | /s3.tf | aws_s3_bucket.logs | Ensure the S3 bucket has access logging enabled |
| 25 | CKV_AWS_7 | /kms.tf | aws_kms_key.logs_key | Ensure rotation for customer created CMKs is enabled |
| 26 | CKV_AWS_16 | /db-app.tf | aws_db_instance.default | Ensure all data stored in the RDS is securely encrypted at rest |
| 27 | CKV_AWS_17 | /db-app.tf | aws_db_instance.default | Ensure all data stored in the RDS bucket is not publicly accessible |
| 28 | CKV_AWS_23 | /db-app.tf | aws_security_group.default | Ensure every security groups rule has a description |
| 29 | CKV_AWS_23 | /db-app.tf | aws_security_group_rule.ingress | Ensure every security groups rule has a description |
| 30 | CKV_AWS_23 | /db-app.tf | aws_security_group_rule.egress | Ensure every security groups rule has a description |
| 31 | CKV_AWS_8 | /db-app.tf | aws_instance.db_app | Ensure all data stored in the Launch configuration EBS is securely encrypted |
| 32 | CKV_AWS_41 | /providers.tf | aws | Ensure no hardcoded AWS access key and secret key exists in provider |
| 33 | CKV_AWS_40 | /iam.tf | aws_iam_user_policy.userpolicy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce the opportunity for a principal to inadvertently receive or retain excessive privileges.) |
| 34 | CKV_AWS_50 | /lambda.tf | aws_lambda_function.analysis_lambda | X-ray tracing is enabled for Lambda |
| 35 | CKV_AWS_45 | /lambda.tf | aws_lambda_function.analysis_lambda | Ensure no hardcoded AWS access key and secret key exists in lambda environment |
Changelog v0.6
-
update resource scan result doc
Install
Copyright (C) 2020 bridgecrewio
