Open
Conversation
![prisma-cloud-devsecops[bot]](https://avatars.githubusercontent.com/in/135857?s=60&v=4){kind=small}
| AccessControl: PublicRead | ||
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 |
There was a problem hiding this comment.
AWS Access logging not enabled on S3 buckets
Resource: AWS | Bridgecrew ID: BC_AWS_S3_13 | Checkov ID: CKV_AWS_18
Description
Access logging provides detailed audit logging for all objects and folders in an S3 bucket.Benchmarks
- HIPAA 164.312(B) Audit controls
| SubnetId: !Ref WebSubnet | ||
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 |
There was a problem hiding this comment.
EC2 user data exposes secrets
Resource: AWS | Bridgecrew ID: BC_AWS_SECRETS_1 | Checkov ID: CKV_AWS_46
Description
**User Data** is a metadata field of an EC2 instance that allows custom code to run after the instance is launched. It contains code exposed to any entity which has the most basic access to EC2, even read-only configurations. This code is not encrypted.Removing secrets from easily-accessed unencrypted places reduces the risk of passwords, private keys and more from being exposed to third parties.
| SSEAlgorithm: aws:kms | ||
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 |
There was a problem hiding this comment.
AWS Access logging not enabled on S3 buckets
Resource: AWS | Bridgecrew ID: BC_AWS_S3_13 | Checkov ID: CKV_AWS_18
Description
Access logging provides detailed audit logging for all objects and folders in an S3 bucket.Benchmarks
- HIPAA 164.312(B) Audit controls
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" |
There was a problem hiding this comment.
Suggested change
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" | |
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" | |
| VersioningConfiguration: | |
| Status: Enabled | |
AWS S3 Object Versioning is disabled
Resource: AWS | Bridgecrew ID: BC_AWS_S3_16 | Checkov ID: CKV_AWS_21
Description
S3 versioning is a managed data backup and recovery service provided by AWS. When enabled it allows users to retrieve and restore previous versions of their buckets.S3 versioning can be used for data protection and retention scenarios such as recovering objects that have been accidentally/intentionally deleted or overwritten.
Benchmarks
- PCI-DSS V3.2.1 10.5.3
- FEDRAMP (MODERATE) CP-10, SI-12
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" |
There was a problem hiding this comment.
Suggested change
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" | |
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" | |
| PublicAccessBlockConfiguration: | |
| IgnorePublicAcls: True | |
AWS S3 bucket IgnorePublicAcls is not set to True
Resource: AWS | Bridgecrew ID: BC_AWS_S3_21 | Checkov ID: CKV_AWS_55
How to Fix
Type: 'AWS::S3::Bucket'
Properties:
...
PublicAccessBlockConfiguration:
...
+ IgnorePublicAcls: trueDescription
The IgnorePublicAcls setting causes S3 to ignore all public ACLs on a bucket and any objects that it contains. Enabling this setting does not affect the persistence of any existing ACLs and does not prevent new public ACLs from being set.This setting will block public access granted by ACLs while still allowing PUT Object calls that include a public ACL.
| PubliclyAccessible: True | ||
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 |
There was a problem hiding this comment.
AWS RDS DB cluster encryption is disabled
Resource: AWS | Bridgecrew ID: BC_AWS_GENERAL_4 | Checkov ID: CKV_AWS_16
How to Fix
Resources:
DB:
Type: 'AWS::RDS::DBInstance'
Properties:
...
+ StorageEncrypted: trueDescription
AWS RDS is a managed DB service enabling quick deployment and management of MySQL, MariaDB, PostgreSQL, Oracle, and Microsoft SQL Server DB engines. Native RDS encryption helps protect your cloud applications and fulfils compliance requirements for data-at-rest encryption.Benchmarks
- PCI-DSS V3.2.1 3.4
- PCI-DSS V3.2 3
- FEDRAMP (MODERATE) SC-28
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" |
There was a problem hiding this comment.
Suggested change
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" | |
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data" | |
| PublicAccessBlockConfiguration: | |
| BlockPublicAcls: True | |
AWS S3 Buckets has block public access setting disabled
Resource: AWS | Bridgecrew ID: BC_AWS_S3_19 | Checkov ID: CKV_AWS_53
Description
Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.
We recommend you set S3 Bucket BlockPublicAcls to True.
Benchmarks
- CIS AWS V1.3 1.20
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" |
There was a problem hiding this comment.
Suggested change
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | |
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | |
| PublicAccessBlockConfiguration: | |
| BlockPublicAcls: True | |
AWS S3 Buckets has block public access setting disabled
Resource: AWS | Bridgecrew ID: BC_AWS_S3_19 | Checkov ID: CKV_AWS_53
Description
Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.
We recommend you set S3 Bucket BlockPublicAcls to True.
Benchmarks
- CIS AWS V1.3 1.20
| PubliclyAccessible: True | ||
| Tags: | ||
| - Key: Name | ||
| - Key: Name1 |
There was a problem hiding this comment.
AWS Amazon RDS instances Enhanced Monitoring is disabled
Resource: AWS | Bridgecrew ID: BC_AWS_LOGGING_28 | Checkov ID: CKV_AWS_118
Description
Enabling enhanced monitoring for Amazon RDS instances can provide you with additional visibility into the performance and health of your database instances. With enhanced monitoring, you can retrieve real-time performance metrics for your RDS instances at intervals of 1 second, rather than the standard interval of 60 seconds. This can be particularly useful for troubleshooting performance issues, identifying trends in resource utilization, and detecting potential issues before they become problems.| Tags: | ||
| - Key: Name | ||
| - Key: Name1 | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" |
There was a problem hiding this comment.
Suggested change
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | |
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | |
| PublicAccessBlockConfiguration: | |
| BlockPublicPolicy: True | |
AWS S3 Bucket BlockPublicPolicy is not set to True
Resource: AWS | Bridgecrew ID: BC_AWS_S3_20 | Checkov ID: CKV_AWS_54
Description
Amazon S3 Block Public Access policy works at the account level and on individual buckets, including those created in the future. It provides the ability to block existing public access, whether specified by an ACL or a policy, and ensures public access is not granted to newly created items.If an AWS account is used to host a data lake or another business application, blocking public access will serve as an account-level guard against accidental public exposure.
Benchmarks
- PCI-DSS V3.2.1 1.3, 2.2
- FEDRAMP (MODERATE) AC-3, AC-4, AC-6, AC-21(b), SC-7, SC-7(3)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.