Added IaC templates #10

ricardo7364 · 2023-05-30T06:33:19Z

No description provided.

prisma-cloud-devsecops

Prisma Cloud has found errors in this PR ⬇️

prisma-cloud-devsecops · 2023-05-30T06:34:30Z

infra/iac/ec2.tf

@@ -0,0 +1,308 @@
+resource "aws_instance" "web_host" {


AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2)
    Resource: aws_instance.web_host | Bridgecrew ID: 1075559712458155008_AWS_1681209176437 | Checkov ID: CKV_AWS_79

Description
Refer the documentation for more details, https://docs.bridgecrew.io/docs/bc_aws_general_31

     🎉 Fixed by commit 929bd0e - Update infra/iac/ec2.tf,,Co-authored-by: prisma-cloud-devsecops[bot] <89982750+prisma-cloud-devsecops[bot]@users.noreply.github.com>

prisma-cloud-devsecops · 2023-05-30T06:34:30Z

infra/iac/lambda.tf

+
+  environment {
+    variables = {
+      access_key = "AKIAIOSFODNN7EXAMPLE"


AWS Access Keys
Resource: 25910f981e85ca04baf359199dd0bd4a3ae738b6 | Bridgecrew ID: 1075559712458155008_GIT_1683117313208 | Checkov ID: CKV_SECRET_2

Description
Refer the documentation for more details, https://docs.bridgecrew.io/docs/git_secrets_2

s3.tf

prisma-cloud-devsecops · 2023-05-30T06:34:31Z

infra/iac/ec2.tf

+sudo apt-get install -y apache2
+sudo systemctl start apache2
+sudo systemctl enable apache2
+export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA


AWS Access Keys
Resource: fc3f784491eba6121c3bfcc1652a2c57d27b16cb | Bridgecrew ID: 1075559712458155008_GIT_1683117313208 | Checkov ID: CKV_SECRET_2

Description
Refer the documentation for more details, https://docs.bridgecrew.io/docs/git_secrets_2

prisma-cloud-devsecops · 2023-05-30T06:34:31Z

app/Dockerfile

@@ -23,6 +23,8 @@ RUN apt-get update && apt-get upgrade -y && apt-get install \

 # Malware end

+ENV GIT_LAB="glpat-y6gpZeq5K6pgdP4AZmdL"


GitLab Token
Resource: 7fdb9fc2fe38194a305ae90791c91d6788eb3e61 | Bridgecrew ID: 1075559712458155008_GIT_1683288422698 | Checkov ID: CKV_SECRET_44

Description
https://docs.bridgecrew.io/docs/git_secrets_44

prisma-cloud-devsecops · 2023-05-30T06:34:32Z

infra/iac/ec2.tf

@@ -0,0 +1,308 @@
+resource "aws_instance" "web_host" {


EBS volumes do not have encrypted launch configurations
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_GENERAL_13 | Checkov ID: CKV_AWS_8

How to Fix

resource "aws_launch_configuration" "example" { ... instance_type = "t2.micro" + root_block_device { + encrypted = true + } ... }

Description
Amazon Elastic Block Store (EBS) volumes allow you to create encrypted launch configurations when creating EC2 instances and auto scaling. When the entire EBS volume is encrypted, data stored at rest on the volume, disk I/O, snapshots created from the volume, and data in-transit between EBS and EC2 are all encrypted.
Benchmarks

PCI-DSS V3.2 3

     🎉 Fixed by commit 929bd0e - Update infra/iac/ec2.tf,,Co-authored-by: prisma-cloud-devsecops[bot] <89982750+prisma-cloud-devsecops[bot]@users.noreply.github.com>

prisma-cloud-devsecops · 2023-05-30T06:34:32Z

rds.tf

+  subnet_ids  = ["subnet-12345678", "subnet-abcdefgh"]
+}
+
+resource "aws_db_instance" "example" {


Suggested change

resource "aws_db_instance" "example" {

resource "aws_db_instance" "example" {

allocated_storage = 10

engine = "mysql"

engine_version = "8.0.21"

instance_class = "db.t3.micro"

name = "example"

username = "admin"

password = "password123"

db_subnet_group_name = aws_db_subnet_group.example.name

vpc_security_group_ids = [

aws_security_group.allow_all.id,

]

}

AWS RDS database instance is publicly accessible
Resource: aws_db_instance.example | Bridgecrew ID: 1075559712458155008_LIC_1683288370889 | Checkov ID: CKV_AWS_17

Description
https://docs.bridgecrew.io/docs/public_2

🪄 Smart Fix -
Fix based on 100% past actions in this repository

prisma-cloud-devsecops · 2023-05-30T06:34:32Z

infra/iac/ec2.tf

@@ -0,0 +1,308 @@
+resource "aws_instance" "web_host" {


AWS EC2 instance detailed monitoring disabled
    Resource: aws_instance.web_host | Bridgecrew ID: BC_AWS_LOGGING_26 | Checkov ID: CKV_AWS_126

How to Fix

resource "aws_instance" "test" { + monitoring = true }

Description
Enabling detailed monitoring for Amazon Elastic Compute Cloud (EC2) instances can provide you with additional data and insights about the performance and utilization of your instances. : Detailed monitoring can provide you with more data about the utilization of your instances, which can be helpful for capacity planning and optimization.

     🎉 Fixed by commit 929bd0e - Update infra/iac/ec2.tf,,Co-authored-by: prisma-cloud-devsecops[bot] <89982750+prisma-cloud-devsecops[bot]@users.noreply.github.com>

🪄 Smart Fix -
Fix based on 100% past actions in this repository

infra/iac/ec2.tf

prisma-cloud-devsecops · 2023-05-30T06:34:32Z

packages/pom.xml

@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="UTF-8"?>


org.apache.struts_struts2-core 2.5.25 / pom.xml

Total vulnerabilities: 2

Critical: 2 High: 0 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2020-17530 CRITICAL 9.8 2.5.30 Open

CVE-2021-31805 CRITICAL 9.8 2.5.30 Open

Co-authored-by: prisma-cloud-devsecops[bot] <89982750+prisma-cloud-devsecops[bot]@users.noreply.github.com>

prisma-cloud-devsecops

Prisma Cloud has found errors in this PR ⬇️

prisma-cloud-devsecops · 2023-11-09T16:22:46Z

app/Dockerfile

@@ -23,6 +23,8 @@ RUN apt-get update && apt-get upgrade -y && apt-get install \

 # Malware end

+ENV GIT_LAB="glpat-y6gpZeq5K6pgdP4AZmdL"


GitLab Token
Resource: 7fdb9fc2fe38194a305ae90791c91d6788eb3e61 | Policy ID: 1075559712458155008_GIT_1683288422698 | Checkov ID: CKV_SECRET_44

Description
https://docs.bridgecrew.io/docs/git_secrets_44

prisma-cloud-devsecops · 2023-11-09T16:22:46Z

infra/iac/ec2.tf

+sudo apt-get install -y apache2
+sudo systemctl start apache2
+sudo systemctl enable apache2
+export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA


AWS Access Keys
Resource: fc3f784491eba6121c3bfcc1652a2c57d27b16cb | Policy ID: 1075559712458155008_GIT_1683117313208 | Checkov ID: CKV_SECRET_2

Description
Refer the documentation for more details, https://docs.bridgecrew.io/docs/git_secrets_2

prisma-cloud-devsecops · 2023-11-09T16:22:46Z

infra/iac/lambda.tf

+
+  environment {
+    variables = {
+      access_key = "AKIAIOSFODNN7EXAMPLE"


AWS Access Keys
Resource: 25910f981e85ca04baf359199dd0bd4a3ae738b6 | Policy ID: 1075559712458155008_GIT_1683117313208 | Checkov ID: CKV_SECRET_2

Description
Refer the documentation for more details, https://docs.bridgecrew.io/docs/git_secrets_2

prisma-cloud-devsecops · 2023-11-09T16:22:46Z

rds.tf

+  vpc_security_group_ids = [
+    aws_security_group.allow_all.id,
+  ]
+  publicly_accessible    = true


Suggested change

publicly_accessible = true

AWS RDS database instance is publicly accessible
Resource: aws_db_instance.example | Policy ID: 1075559712458155008_LIC_1683288370889 | Checkov ID: CKV_AWS_17

Description
https://docs.bridgecrew.io/docs/public_2

prisma-cloud-devsecops · 2023-11-09T16:22:47Z

packages/pom.xml

+
+    <dependencies>
+        <!--vulnerable dependency start-->
+        <dependency>


org.apache.struts:struts2-core 2.5.25 / pom.xml

Total vulnerabilities: 3

Critical: 2 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2021-31805 CRITICAL 9.8 2.5.30 Open

CVE-2020-17530 CRITICAL 9.8 2.5.30 Open

CVE-2023-34396 HIGH 7.5 2.5.31 Open

ricardo7364 added 9 commits May 11, 2023 12:12

added IaC templates

74c11c3

adding packages

8e3147b

updated pom file

e3d1805

s3 bucket updated

b2e0ebd

updated s3 bucket

dae790e

new s3

b36ebf3

udpated s3 bucket

4092500

added rds

f20fd51

Updated key

4c5c9e4

prisma-cloud-devsecops bot reviewed May 30, 2023

View reviewed changes

ricardo7364 and others added 3 commits May 30, 2023 15:32

Update infra/iac/ec2.tf

929bd0e

Co-authored-by: prisma-cloud-devsecops[bot] <89982750+prisma-cloud-devsecops[bot]@users.noreply.github.com>

updated ec2

3221aa1

Update s3.tf

c648b26

Co-authored-by: prisma-cloud-devsecops[bot] <89982750+prisma-cloud-devsecops[bot]@users.noreply.github.com>

prisma-cloud-devsecops bot reviewed Nov 9, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added IaC templates #10

Added IaC templates #10

ricardo7364 commented May 30, 2023

prisma-cloud-devsecops bot left a comment

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading

prisma-cloud-devsecops bot May 30, 2023

prisma-cloud-devsecops bot May 30, 2023

prisma-cloud-devsecops bot May 30, 2023

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading

prisma-cloud-devsecops bot May 30, 2023

prisma-cloud-devsecops bot left a comment

prisma-cloud-devsecops bot Nov 9, 2023

prisma-cloud-devsecops bot Nov 9, 2023

prisma-cloud-devsecops bot Nov 9, 2023

prisma-cloud-devsecops bot Nov 9, 2023

prisma-cloud-devsecops bot Nov 9, 2023

		@@ -23,6 +23,8 @@ RUN apt-get update && apt-get upgrade -y && apt-get install \

		# Malware end

		ENV GIT_LAB="glpat-y6gpZeq5K6pgdP4AZmdL"

-resource "aws_db_instance" "example" {
+resource "aws_db_instance" "example" {
+  allocated_storage    = 10
+  engine               = "mysql"
+  engine_version       = "8.0.21"
+  instance_class       = "db.t3.micro"
+  name                 = "example"
+  username             = "admin"
+  password             = "password123"
+  db_subnet_group_name = aws_db_subnet_group.example.name
+  vpc_security_group_ids = [
+    aws_security_group.allow_all.id,
+  ]
+}

Vulnerability ID	Severity	CVSS	Fixed in	Status
CVE-2020-17530	CRITICAL	9.8	`2.5.30`	Open
CVE-2021-31805	CRITICAL	9.8	`2.5.30`	Open

Added IaC templates #10

Are you sure you want to change the base?

Added IaC templates #10

Conversation

ricardo7364 commented May 30, 2023

prisma-cloud-devsecops bot left a comment

Choose a reason for hiding this comment

prisma-cloud-devsecops bot May 30, 2023 • edited Loading

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot May 30, 2023

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot May 30, 2023

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot May 30, 2023

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot May 30, 2023 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

Benchmarks

prisma-cloud-devsecops bot May 30, 2023 • edited Loading

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot May 30, 2023 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

prisma-cloud-devsecops bot May 30, 2023

Choose a reason for hiding this comment

org.apache.struts_struts2-core 2.5.25 / pom.xml

Total vulnerabilities: 2

prisma-cloud-devsecops bot left a comment

Choose a reason for hiding this comment

prisma-cloud-devsecops bot Nov 9, 2023

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot Nov 9, 2023

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot Nov 9, 2023

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot Nov 9, 2023

Choose a reason for hiding this comment

Description

prisma-cloud-devsecops bot Nov 9, 2023

Choose a reason for hiding this comment

org.apache.struts:struts2-core 2.5.25 / pom.xml

Total vulnerabilities: 3

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading

prisma-cloud-devsecops bot May 30, 2023 •

edited

Loading