Checkov files #20
Checkov files #20
Conversation
📝 WalkthroughWalkthroughA new Terraform configuration file was introduced, specifying an AWS provider in the "us-east-1" region. It defines an S3 bucket with public-read access and a security group that allows unrestricted SSH access and outbound traffic. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Terraform
participant AWS
User->>Terraform: Apply configuration
Terraform->>AWS: Create S3 bucket (public-read)
Terraform->>AWS: Create security group (open ingress/egress)
AWS-->>Terraform: Resources provisioned
Terraform-->>User: Provisioning complete
Poem
Impact AnalysisIntroduction of insecure AWS resources with public accessThis change adds a Terraform configuration that creates an S3 bucket with public-read access and a security group allowing unrestricted SSH (port 22) access from any IP address, as well as unrestricted outbound traffic. These configurations expose resources to the public internet, significantly increasing the risk of unauthorized access and data breaches. Deploy the Terraform configuration in a controlled environment and verify that the S3 bucket is publicly accessible and that the security group allows SSH access from any IP. Test for unintended exposure of sensitive data and confirm that security monitoring detects these insecure configurations. 🔍 Related Files
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
checkov/test.tf (3)
5-8: Lifecycle configuration missing – objects will live forever.Checkov (CKV2_AWS_61) flags the absence of a lifecycle rule. Add a rule to abort incomplete multipart uploads and optionally expire/archive objects to control storage costs.
bucket = "my-insecure-bucket" acl = "public-read" + + lifecycle_rule { + id = "abort-incomplete-mpu" + status = "Enabled" + + abort_incomplete_multipart_upload_days = 7 + }
19-24: Full egress to everywhere – tighten if possible.While AWS allows 0.0.0.0/0 egress by default, locking outbound traffic to required destinations only (e.g., AWS services, on-prem CIDRs) reduces blast radius if the instance is compromised.
- cidr_blocks = ["0.0.0.0/0"] + # Restrict egress to necessary networks + cidr_blocks = ["10.0.0.0/16"]
1-3: Hard-coding region reduces reuse.Consider parameterising the region via a variable to support multi-region deployments.
-provider "aws" { - region = "us-east-1" -} +variable "aws_region" { + description = "AWS region to deploy into" + type = string + default = "us-east-1" +} + +provider "aws" { + region = var.aws_region +}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
checkov/test.tf(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
checkov/test.tf
[MEDIUM] 5-8: Ensure that an S3 bucket has a lifecycle configuration
(CKV2_AWS_61)
[HIGH] 5-8: S3 Bucket has an ACL defined which allows public READ access.
(CKV_AWS_20)
| resource "aws_s3_bucket" "bad_bucket" { | ||
| bucket = "my-insecure-bucket" | ||
| acl = "public-read" | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Public-read ACL creates a world-readable bucket – lock it down.
The acl = "public-read" line exposes every object in my-insecure-bucket to the entire internet. Unless the business case explicitly requires anonymous access (and most don’t), switch to a private ACL and add encryption / versioning / lifecycle controls.
- acl = "public-read"
+ acl = "private"
+
+# Enable versioning to guard against accidental deletes
+ versioning {
+ enabled = true
+ }
+
+# Default encryption at rest (SSE-KMS)
+ server_side_encryption_configuration {
+ rule {
+ apply_server_side_encryption_by_default {
+ sse_algorithm = "aws:kms"
+ }
+ }
+ }Add a separate Public Access Block resource to guarantee nothing re-opens the bucket:
+resource "aws_s3_bucket_public_access_block" "bad_bucket_pab" {
+ bucket = aws_s3_bucket.bad_bucket.id
+
+ block_public_acls = true
+ ignore_public_acls = true
+ block_public_policy = true
+ restrict_public_buckets = true
+}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| resource "aws_s3_bucket" "bad_bucket" { | |
| bucket = "my-insecure-bucket" | |
| acl = "public-read" | |
| } | |
| resource "aws_s3_bucket" "bad_bucket" { | |
| bucket = "my-insecure-bucket" | |
| acl = "private" | |
| # Enable versioning to guard against accidental deletes | |
| versioning { | |
| enabled = true | |
| } | |
| # Default encryption at rest (SSE-KMS) | |
| server_side_encryption_configuration { | |
| rule { | |
| apply_server_side_encryption_by_default { | |
| sse_algorithm = "aws:kms" | |
| } | |
| } | |
| } | |
| } | |
| resource "aws_s3_bucket_public_access_block" "bad_bucket_pab" { | |
| bucket = aws_s3_bucket.bad_bucket.id | |
| block_public_acls = true | |
| ignore_public_acls = true | |
| block_public_policy = true | |
| restrict_public_buckets = true | |
| } |
🧰 Tools
🪛 Checkov (3.2.334)
[MEDIUM] 5-8: Ensure that an S3 bucket has a lifecycle configuration
(CKV2_AWS_61)
[HIGH] 5-8: S3 Bucket has an ACL defined which allows public READ access.
(CKV_AWS_20)
🤖 Prompt for AI Agents
In checkov/test.tf around lines 5 to 8, the S3 bucket is configured with a
public-read ACL, making it world-readable. Change the ACL to "private" to
restrict access, and add encryption, versioning, and lifecycle policies as
needed. Additionally, create a separate aws_s3_bucket_public_access_block
resource to block any public access settings and ensure the bucket remains
secure.
| resource "aws_security_group" "bad_sg" { | ||
| name = "open-sg" | ||
| description = "Security group with open ingress" | ||
| ingress { | ||
| from_port = 22 | ||
| to_port = 22 | ||
| protocol = "tcp" | ||
| cidr_blocks = ["0.0.0.0/0"] | ||
| } |
There was a problem hiding this comment.
SSH open to the world (0.0.0.0/0) – huge attack surface.
Unrestricted port 22 access invites automated scanning and brute-force attacks. Limit the source CIDR to a known bastion IP range or, better, drop public SSH and use SSM Session Manager.
- cidr_blocks = ["0.0.0.0/0"]
+ # Example: restrict to corporate office IP range
+ cidr_blocks = ["203.0.113.0/24"]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| resource "aws_security_group" "bad_sg" { | |
| name = "open-sg" | |
| description = "Security group with open ingress" | |
| ingress { | |
| from_port = 22 | |
| to_port = 22 | |
| protocol = "tcp" | |
| cidr_blocks = ["0.0.0.0/0"] | |
| } | |
| resource "aws_security_group" "bad_sg" { | |
| name = "open-sg" | |
| description = "Security group with open ingress" | |
| ingress { | |
| from_port = 22 | |
| to_port = 22 | |
| protocol = "tcp" | |
| # Example: restrict to corporate office IP range | |
| cidr_blocks = ["203.0.113.0/24"] | |
| } | |
| } |
🤖 Prompt for AI Agents
In checkov/test.tf around lines 10 to 18, the security group ingress rule allows
SSH (port 22) from any IP address (0.0.0.0/0), creating a large attack surface.
To fix this, restrict the cidr_blocks value to a specific known IP range such as
a bastion host's IP or remove the public SSH access entirely and configure
access through AWS Systems Manager Session Manager instead.
Summary by CodeRabbit