Create s3.tf #35

ayala-orca · 2023-04-30T20:03:11Z

No description provided.

ghost

Orca Security Scan Summary

Status	Check	Issues by priority
Failed	Infrastructure as Code	10 6 0 0
Passed	Vulnerabilities	0 0 0 0
Passed	Secrets	0 0 0 0

jit-ci

❌ Jit has detected 5 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.

jit-ci · 2023-04-30T20:04:36Z

aws/s3.tf

+  })
+}
+
+resource "aws_s3_bucket_object" "data_object" {


Security control: Iac Misconfig Detection Terraform

Type: S3 Bucket Object Should Have Server-Side Encryption Enabled

Description: S3 Bucket Object should have server-side encryption enabled

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

S3 Bucket Object should have server-side encryption enabled . This can be achieved by adding the enable server_side_encryption key.

Suggested change

resource "aws_s3_bucket_object" "data_object" {

resource "aws_s3_bucket_object" "data_object" {

server_side_encryption = "AES256"

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-04-30T20:04:36Z

aws/s3.tf

@@ -0,0 +1,141 @@
+resource "aws_s3_bucket" "data" {


Security control: Iac Misconfig Detection Terraform

Type: If Algorithm Is Aes256 Then The Master Key Is Null, Empty Or Undefined, Otherwise The Master Key Is Required

Description: If algorithm is AES256 then the master key is null, empty or undefined, otherwise the master key is required

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

You can encrypt buckets by simply set the server_side_encryption attribute to AES256 in the config. The AES256 encryption method does not required mater key so it standalone in the config.

Suggested change

resource "aws_s3_bucket" "data" {

resource "aws_s3_bucket" "data" {

server_side_encryption_configuration {

rule {

apply_server_side_encryption_by_default {

sse_algorithm = "AES256"

}

}

}

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-04-30T20:04:36Z

aws/s3.tf

+  })
+}
+
+resource "aws_s3_bucket" "data_science" {


Security control: Iac Misconfig Detection Terraform

Type: If Algorithm Is Aes256 Then The Master Key Is Null, Empty Or Undefined, Otherwise The Master Key Is Required

Description: If algorithm is AES256 then the master key is null, empty or undefined, otherwise the master key is required

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

You can encrypt buckets by simply set the server_side_encryption attribute to AES256 in the config. The AES256 encryption method does not required mater key so it standalone in the config.

Suggested change

resource "aws_s3_bucket" "data_science" {

resource "aws_s3_bucket" "data_science" {

server_side_encryption_configuration {

rule {

apply_server_side_encryption_by_default {

sse_algorithm = "AES256"

}

}

}

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-04-30T20:04:36Z

aws/s3.tf

+
+}
+
+resource "aws_s3_bucket" "operations" {


Security control: Iac Misconfig Detection Terraform

Type: If Algorithm Is Aes256 Then The Master Key Is Null, Empty Or Undefined, Otherwise The Master Key Is Required

Description: If algorithm is AES256 then the master key is null, empty or undefined, otherwise the master key is required

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

You can encrypt buckets by simply set the server_side_encryption attribute to AES256 in the config. The AES256 encryption method does not required mater key so it standalone in the config.

Suggested change

resource "aws_s3_bucket" "operations" {

resource "aws_s3_bucket" "operations" {

server_side_encryption_configuration {

rule {

apply_server_side_encryption_by_default {

sse_algorithm = "AES256"

}

}

}

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

jit-ci · 2023-04-30T20:04:36Z

aws/s3.tf

+  })
+}
+
+resource "aws_s3_bucket" "financials" {


Security control: Iac Misconfig Detection Terraform

Type: If Algorithm Is Aes256 Then The Master Key Is Null, Empty Or Undefined, Otherwise The Master Key Is Required

Description: If algorithm is AES256 then the master key is null, empty or undefined, otherwise the master key is required

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

You can encrypt buckets by simply set the server_side_encryption attribute to AES256 in the config. The AES256 encryption method does not required mater key so it standalone in the config.

Suggested change

resource "aws_s3_bucket" "financials" {

resource "aws_s3_bucket" "financials" {

server_side_encryption_configuration {

rule {

apply_server_side_encryption_by_default {

sse_algorithm = "AES256"

}

}

}

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_undo_ignore Undo ignore command

ghost

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Vulnerabilities	0 0 0 0
Passed	Secrets	0 0 0 0

ghost

Orca Security Scan Summary

Status	Check	Issues by priority
Failed	Infrastructure as Code	10 6 0 0
Passed	Vulnerabilities	0 0 0 0
Passed	Secrets	0 0 0 0

ayala-orca

bla3

ayala-orca · 2023-05-02T07:35:54Z

aws/s3.tf

@@ -0,0 +1,141 @@
+resource "aws_s3_bucket" "data" {


ayala-orca · 2023-05-02T07:36:01Z

aws/s3.tf

+  # bucket does not have versioning
+  bucket        = "${local.resource_prefix.value}-data"
+  force_destroy = true
+  tags = merge({


ayala-orca · 2023-05-02T07:37:38Z

aws/s3.tf

+resource "aws_s3_bucket" "data" {
+  # bucket is public
+  # bucket is not encrypted
+  # bucket does not have access logs


ayala-orca · 2023-05-02T07:37:55Z

aws/s3.tf

+    git_file             = "terraform/aws/s3.tf"
+    git_last_modified_at = "2020-06-16 14:46:24"
+    git_last_modified_by = "[email protected]"
+    git_modifiers        = "nimrodkor"


ayala-orca · 2023-05-02T07:38:08Z

aws/s3.tf

+    git_org              = "bridgecrewio"
+    git_repo             = "terragoat"
+    yor_trace            = "a7f01cc7-63c2-41a8-8555-6665e5e39a64"
+  })


Create s3.tf

9e97d34

ghost reviewed Apr 30, 2023

View reviewed changes

jit-ci bot reviewed Apr 30, 2023

View reviewed changes

ghost reviewed Apr 30, 2023

View reviewed changes

ghost reviewed May 1, 2023

View reviewed changes

ayala-orca commented May 2, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create s3.tf #35

Create s3.tf #35

ayala-orca commented Apr 30, 2023

ghost left a comment

jit-ci bot left a comment

jit-ci bot Apr 30, 2023

jit-ci bot Apr 30, 2023

jit-ci bot Apr 30, 2023

jit-ci bot Apr 30, 2023

jit-ci bot Apr 30, 2023

ghost left a comment

ghost left a comment

ayala-orca left a comment

ayala-orca May 2, 2023

ayala-orca May 2, 2023

ayala-orca May 2, 2023

ayala-orca May 2, 2023

ayala-orca May 2, 2023

	resource "aws_s3_bucket_object" "data_object" {
	resource "aws_s3_bucket_object" "data_object" {
	server_side_encryption = "AES256"

-resource "aws_s3_bucket" "data" {
+resource "aws_s3_bucket" "data" {
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        sse_algorithm     = "AES256"
+      }
+    }
+  }

Create s3.tf #35

Are you sure you want to change the base?

Create s3.tf #35

Conversation

ayala-orca commented Apr 30, 2023

ghost left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

jit-ci bot left a comment

Choose a reason for hiding this comment

jit-ci bot Apr 30, 2023

Choose a reason for hiding this comment

jit-ci bot Apr 30, 2023

Choose a reason for hiding this comment

jit-ci bot Apr 30, 2023

Choose a reason for hiding this comment

jit-ci bot Apr 30, 2023

Choose a reason for hiding this comment

jit-ci bot Apr 30, 2023

Choose a reason for hiding this comment

ghost left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

ghost left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

ayala-orca left a comment

Choose a reason for hiding this comment

ayala-orca May 2, 2023

Choose a reason for hiding this comment

ayala-orca May 2, 2023

Choose a reason for hiding this comment

ayala-orca May 2, 2023

Choose a reason for hiding this comment

ayala-orca May 2, 2023

Choose a reason for hiding this comment

ayala-orca May 2, 2023

Choose a reason for hiding this comment