Skip to content

Commit a310c3a

Browse files
jkamenikjkamenik
committed
Adding VPC SG tests
1 parent 72b4e7a commit a310c3a

File tree

11 files changed

+239
-2
lines changed

11 files changed

+239
-2
lines changed

‎aws/cloudformation/abstract/vpc-flow-logs-missing/README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# VPC Flow Logs Missing
2+
3+
Here there are no flow logs. A flow log block should be added
4+
5+
## Unguessable info
6+
7+
The expectation assumes the following:
8+
9+
1. The VPC Flow Log Object Name: `FlowLogBucket`
10+
1. The VPC Flow Log LogDestination: `!Sub "arn:aws:s3:::gomboc-security-flowlogs-480437182633/${VPC}/"`

‎aws/cloudformation/abstract/vpc-flow-logs-missing/expected/main.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
3+
Transform: AWS::Serverless-2016-10-31
4+
5+
Parameters:
6+
EnvironmentName:
7+
Description: An environment name that is prefixed to resource names
8+
Type: String
9+
Default: iac-scanning-poc-cf
10+
11+
Resources:
12+
VPC:
13+
Type: AWS::EC2::VPC
14+
Properties:
15+
CidrBlock: 10.0.0.0/16
16+
EnableDnsSupport: true
17+
EnableDnsHostnames: true
18+
Tags:
19+
- Key: Name
20+
Value: !Ref EnvironmentName
21+
22+
FlowLogBucket:
23+
Type: AWS::EC2::FlowLog
24+
Properties:
25+
LogDestination: !Sub "arn:aws:s3:::gomboc-security-flowlogs-480437182633/${VPC}/"
26+
LogDestinationType: s3
27+
ResourceId: !Ref VPC
28+
ResourceType: VPC
29+
TrafficType: ALL

‎aws/cloudformation/abstract/vpc-flow-logs-missing/main.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
3+
Transform: AWS::Serverless-2016-10-31
4+
5+
Parameters:
6+
EnvironmentName:
7+
Description: An environment name that is prefixed to resource names
8+
Type: String
9+
Default: iac-scanning-poc-cf
10+
11+
Resources:
12+
VPC:
13+
Type: AWS::EC2::VPC
14+
Properties:
15+
CidrBlock: 10.0.0.0/16
16+
EnableDnsSupport: true
17+
EnableDnsHostnames: true
18+
Tags:
19+
- Key: Name
20+
Value: !Ref EnvironmentName

‎aws/cloudformation/abstract/vpc-undefined-default-sg/README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# VPC with undefined Default SG
2+
3+
A VPC without a defined default SG has an insecure enabled. There is no way to prevent that, so the best solution is to make the default SG useless.
4+
5+
## Unguessable Information
6+
7+
The expected results assumes the following:
8+
9+
1. The VPC SG safe port is "65535"
10+
2. The VPC SG safe CIDR is "1.1.1.1/32"

‎aws/cloudformation/abstract/vpc-undefined-default-sg/expected/main.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
AWSTemplateFormatVersion: 2010-09-09
3+
4+
Transform: AWS::Serverless-2016-10-31
5+
6+
Parameters:
7+
EnvironmentName:
8+
Description: An environment name that is prefixed to resource names
9+
Type: String
10+
Default: iac-scanning-poc-cf
11+
12+
Resources:
13+
#################################
14+
## This section is for the VPC ##
15+
#################################
16+
VPC:
17+
Type: AWS::EC2::VPC
18+
Properties:
19+
CidrBlock: 10.0.0.0/16
20+
EnableDnsSupport: true
21+
EnableDnsHostnames: true
22+
Tags:
23+
- Key: Name
24+
Value: !Ref EnvironmentName
25+
26+
DefaultSecurityGroupIngress:
27+
Type: AWS::EC2::SecurityGroupIngress
28+
Properties:
29+
GroupId: !GetAtt VPC.DefaultSecurityGroup
30+
IpProtocol: tcp
31+
FromPort: 65535
32+
ToPort: 65535
33+
CidrIp: 1.1.1.1/32
34+
35+
VPCFlowLogs:
36+
Type: AWS::EC2::FlowLog
37+
Properties:
38+
LogDestination: !Sub "arn:aws:s3:::gomboc-security-flowlogs-480437182633/${VPC}/"
39+
LogDestinationType: s3
40+
ResourceId: !Ref VPC
41+
ResourceType: VPC
42+
TrafficType: ALL

‎aws/cloudformation/abstract/vpc-undefined-default-sg/main.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
AWSTemplateFormatVersion: 2010-09-09
3+
4+
Transform: AWS::Serverless-2016-10-31
5+
6+
Parameters:
7+
EnvironmentName:
8+
Description: An environment name that is prefixed to resource names
9+
Type: String
10+
Default: iac-scanning-poc-cf
11+
12+
Resources:
13+
#################################
14+
## This section is for the VPC ##
15+
#################################
16+
VPC:
17+
Type: AWS::EC2::VPC
18+
Properties:
19+
CidrBlock: 10.0.0.0/16
20+
EnableDnsSupport: true
21+
EnableDnsHostnames: true
22+
Tags:
23+
- Key: Name
24+
Value: !Ref EnvironmentName
25+
26+
VPCFlowLogs:
27+
Type: AWS::EC2::FlowLog
28+
Properties:
29+
LogDestination: !Sub "arn:aws:s3:::gomboc-security-flowlogs-480437182633/${VPC}/"
30+
LogDestinationType: s3
31+
ResourceId: !Ref VPC
32+
ResourceType: VPC
33+
TrafficType: ALL

‎aws/cloudformation/abstract/vpc-unsafe-default-sg/README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# VPC with undefined Default SG
2+
3+
This is a VPC where the Default SG has unsafe settings
4+
5+
## Unguessable Information
6+
7+
The expected results assumes the following:
8+
9+
1. The VPC SG safe port is "65535"
10+
2. The VPC SG safe CIDR is "1.1.1.1/32"

‎aws/cloudformation/abstract/vpc-unsafe-default-sg/expected/main.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
AWSTemplateFormatVersion: 2010-09-09
3+
4+
Transform: AWS::Serverless-2016-10-31
5+
6+
Parameters:
7+
EnvironmentName:
8+
Description: An environment name that is prefixed to resource names
9+
Type: String
10+
Default: iac-scanning-poc-cf
11+
12+
Resources:
13+
#################################
14+
## This section is for the VPC ##
15+
#################################
16+
VPC:
17+
Type: AWS::EC2::VPC
18+
Properties:
19+
CidrBlock: 10.0.0.0/16
20+
EnableDnsSupport: true
21+
EnableDnsHostnames: true
22+
Tags:
23+
- Key: Name
24+
Value: !Ref EnvironmentName
25+
26+
VPCFlowLogs:
27+
Type: AWS::EC2::FlowLog
28+
Properties:
29+
LogDestination: !Sub "arn:aws:s3:::gomboc-security-flowlogs-480437182633/${VPC}/"
30+
LogDestinationType: s3
31+
ResourceId: !Ref VPC
32+
ResourceType: VPC
33+
TrafficType: ALL
34+
35+
DefaultSG:
36+
Type: AWS::EC2::SecurityGroupIngress
37+
Properties:
38+
GroupId: !GetAtt VPC.DefaultSecurityGroup
39+
IpProtocol: tcp
40+
FromPort: 65535
41+
ToPort: 65535
42+
CidrIp: 1.1.1.1/32

‎aws/cloudformation/abstract/vpc-unsafe-default-sg/main.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
AWSTemplateFormatVersion: 2010-09-09
3+
4+
Transform: AWS::Serverless-2016-10-31
5+
6+
Parameters:
7+
EnvironmentName:
8+
Description: An environment name that is prefixed to resource names
9+
Type: String
10+
Default: iac-scanning-poc-cf
11+
12+
Resources:
13+
#################################
14+
## This section is for the VPC ##
15+
#################################
16+
VPC:
17+
Type: AWS::EC2::VPC
18+
Properties:
19+
CidrBlock: 10.0.0.0/16
20+
EnableDnsSupport: true
21+
EnableDnsHostnames: true
22+
Tags:
23+
- Key: Name
24+
Value: !Ref EnvironmentName
25+
26+
VPCFlowLogs:
27+
Type: AWS::EC2::FlowLog
28+
Properties:
29+
LogDestination: !Sub "arn:aws:s3:::gomboc-security-flowlogs-480437182633/${VPC}/"
30+
LogDestinationType: s3
31+
ResourceId: !Ref VPC
32+
ResourceType: VPC
33+
TrafficType: ALL
34+
35+
DefaultSG:
36+
Type: AWS::EC2::SecurityGroupIngress
37+
Properties:
38+
GroupId: !GetAtt VPC.DefaultSecurityGroup
39+
IpProtocol: tcp
40+
FromPort: 0
41+
ToPort: 65535

‎aws/cloudformation/iac-scanning-poc/expected/main.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -269,8 +269,8 @@ Resources:
269269
BlockDeviceMappings:
270270
- DeviceName: /dev/xvda
271271
Ebs:
272-
VolumeSize: 20
273272
Encrypted: true
273+
VolumeSize: 20
274274
- DeviceName: /dev/xvdb
275275
Ebs:
276276
VolumeSize: 20

0 commit comments

Comments
 (0)