Spaces:
Sleeping
Sleeping
| """ | |
| Security rules configuration for different IaC platforms | |
| """ | |
| from typing import Dict, List | |
| from models import SecurityRule | |
| def get_terraform_rules() -> List[SecurityRule]: | |
| """Get Terraform security rules""" | |
| return [ | |
| SecurityRule( | |
| rule_id="TF001", | |
| title="Public S3 Bucket", | |
| severity="high", | |
| patterns=[ | |
| r'acl\s*=\s*["\']public-read["\']', | |
| r'acl\s*=\s*["\']public-read-write["\']', | |
| r'block_public_acls\s*=\s*false', | |
| r'ignore_public_acls\s*=\s*false', | |
| r'block_public_policy\s*=\s*false', | |
| r'restrict_public_buckets\s*=\s*false' | |
| ], | |
| description="S3 bucket is configured with public access, which may expose sensitive data to unauthorized users.", | |
| recommendation="Use private ACL and configure specific bucket policies. Enable S3 bucket public access block.", | |
| fix_example='acl = "private"\n\nbucket_public_access_block {\n block_public_acls = true\n block_public_policy = true\n ignore_public_acls = true\n restrict_public_buckets = true\n}', | |
| category="Data Protection", | |
| cwe_id="CWE-200", | |
| cvss_score=7.5 | |
| ), | |
| SecurityRule( | |
| rule_id="TF002", | |
| title="Unencrypted EBS Volume", | |
| severity="high", | |
| patterns=[ | |
| r'resource\s+["\']aws_ebs_volume["\'][^}]*?(?!.*encrypted\s*=\s*true)[^}]*?}', | |
| r'ebs_block_device\s*{[^}]*?(?!.*encrypted\s*=\s*true)[^}]*?}' | |
| ], | |
| description="EBS volumes are not encrypted, potentially exposing sensitive data at rest.", | |
| recommendation="Enable encryption for all EBS volumes using AWS KMS keys to protect data at rest.", | |
| fix_example='encrypted = true\nkms_key_id = aws_kms_key.ebs.arn', | |
| category="Encryption", | |
| cwe_id="CWE-311", | |
| cvss_score=6.5 | |
| ), | |
| SecurityRule( | |
| rule_id="TF003", | |
| title="Open Security Group - Inbound", | |
| severity="critical", | |
| patterns=[ | |
| r'ingress\s*{[^}]*cidr_blocks\s*=\s*\[[^]]*["\']0\.0\.0\.0/0["\'][^]]*\]', | |
| r'from_port\s*=\s*0[^}]*to_port\s*=\s*65535[^}]*cidr_blocks\s*=\s*\[[^]]*["\']0\.0\.0\.0/0["\']', | |
| r'protocol\s*=\s*["\']tcp["\'][^}]*from_port\s*=\s*22[^}]*cidr_blocks\s*=\s*\[[^]]*["\']0\.0\.0\.0/0["\']' | |
| ], | |
| description="Security group allows unrestricted inbound access from the internet (0.0.0.0/0).", | |
| recommendation="Restrict inbound rules to specific IP ranges, security groups, or use AWS Systems Manager Session Manager for SSH access.", | |
| fix_example='cidr_blocks = ["10.0.0.0/8", "172.16.0.0/12"]\n# Or use security group references\nsecurity_groups = [aws_security_group.app.id]', | |
| category="Network Security", | |
| cwe_id="CWE-16", | |
| cvss_score=9.0 | |
| ), | |
| SecurityRule( | |
| rule_id="TF004", | |
| title="Unencrypted RDS Instance", | |
| severity="high", | |
| patterns=[ | |
| r'resource\s+["\']aws_db_instance["\'][^}]*?(?!.*storage_encrypted\s*=\s*true)[^}]*?}' | |
| ], | |
| description="RDS database instance is not encrypted, potentially exposing sensitive data.", | |
| recommendation="Enable encryption for RDS instances and consider encryption in transit.", | |
| fix_example='storage_encrypted = true\nkms_key_id = aws_kms_key.rds.arn', | |
| category="Database Security", | |
| cwe_id="CWE-311", | |
| cvss_score=7.0 | |
| ), | |
| SecurityRule( | |
| rule_id="TF005", | |
| title="IAM Policy with Wildcard Actions", | |
| severity="medium", | |
| patterns=[ | |
| r'["\']Action["\']\s*[:=]\s*["\'][*]["\']', | |
| r'["\']Resource["\']\s*[:=]\s*["\'][*]["\']' | |
| ], | |
| description="IAM policy uses wildcard (*) for actions or resources, potentially granting excessive permissions.", | |
| recommendation="Follow the principle of least privilege by specifying exact actions and resources.", | |
| fix_example='"Action": ["s3:GetObject", "s3:PutObject"],\n"Resource": ["arn:aws:s3:::my-bucket/*"]', | |
| category="Access Control", | |
| cwe_id="CWE-269", | |
| cvss_score=5.5 | |
| ) | |
| ] | |
| def get_cloudformation_rules() -> List[SecurityRule]: | |
| """Get CloudFormation security rules""" | |
| return [ | |
| SecurityRule( | |
| rule_id="CF001", | |
| title="Public S3 Bucket Access", | |
| severity="high", | |
| patterns=[ | |
| r'AccessControl["\']?\s*:\s*["\']?PublicRead', | |
| r'AccessControl["\']?\s*:\s*["\']?PublicReadWrite', | |
| r'Principal["\']?\s*:\s*["\']?\*["\']?' | |
| ], | |
| description="S3 bucket allows public access which may expose sensitive data.", | |
| recommendation="Configure proper bucket policies and disable public access blocks.", | |
| fix_example='"AccessControl": "Private",\n"PublicAccessBlockConfiguration": {\n "BlockPublicAcls": true,\n "BlockPublicPolicy": true\n}', | |
| category="Data Protection", | |
| cwe_id="CWE-200", | |
| cvss_score=7.5 | |
| ), | |
| SecurityRule( | |
| rule_id="CF002", | |
| title="Open Security Group", | |
| severity="critical", | |
| patterns=[ | |
| r'CidrIp["\']?\s*:\s*["\']?0\.0\.0\.0/0["\']?', | |
| r'IpProtocol["\']?\s*:\s*["\']?-1["\']?' | |
| ], | |
| description="Security group allows traffic from any IP address or all protocols.", | |
| recommendation="Restrict access to specific IP ranges and required protocols only.", | |
| fix_example='"CidrIp": "10.0.0.0/8",\n"IpProtocol": "tcp",\n"FromPort": 80,\n"ToPort": 80', | |
| category="Network Security", | |
| cwe_id="CWE-16", | |
| cvss_score=9.0 | |
| ) | |
| ] | |
| def get_kubernetes_rules() -> List[SecurityRule]: | |
| """Get Kubernetes security rules""" | |
| return [ | |
| SecurityRule( | |
| rule_id="K8S001", | |
| title="Container Running as Root", | |
| severity="high", | |
| patterns=[ | |
| r'runAsUser\s*:\s*0', | |
| r'runAsRoot\s*:\s*true', | |
| r'(?!.*runAsNonRoot\s*:\s*true)' | |
| ], | |
| description="Container is configured to run as root user, increasing attack surface.", | |
| recommendation="Configure containers to run as non-root user with minimal privileges.", | |
| fix_example='securityContext:\n runAsUser: 1000\n runAsNonRoot: true\n readOnlyRootFilesystem: true', | |
| category="Container Security", | |
| cwe_id="CWE-250", | |
| cvss_score=6.0 | |
| ), | |
| SecurityRule( | |
| rule_id="K8S002", | |
| title="Privileged Container", | |
| severity="critical", | |
| patterns=[ | |
| r'privileged\s*:\s*true', | |
| r'allowPrivilegeEscalation\s*:\s*true' | |
| ], | |
| description="Container is running in privileged mode, which grants access to host resources.", | |
| recommendation="Avoid privileged containers unless absolutely necessary. Use specific capabilities instead.", | |
| fix_example='securityContext:\n privileged: false\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL', | |
| category="Container Security", | |
| cwe_id="CWE-250", | |
| cvss_score=8.5 | |
| ), | |
| SecurityRule( | |
| rule_id="K8S003", | |
| title="Missing Resource Limits", | |
| severity="medium", | |
| patterns=[ | |
| r'containers\s*:(?!.*limits\s*:)', | |
| r'(?!.*resources\s*:.*limits)' | |
| ], | |
| description="Container has no resource limits defined, which may lead to resource exhaustion.", | |
| recommendation="Set appropriate CPU and memory limits to prevent resource starvation.", | |
| fix_example='resources:\n limits:\n cpu: "500m"\n memory: "512Mi"\n requests:\n cpu: "250m"\n memory: "256Mi"', | |
| category="Resource Management", | |
| cwe_id="CWE-400", | |
| cvss_score=4.0 | |
| ) | |
| ] | |
| def get_all_security_rules() -> Dict[str, List[SecurityRule]]: | |
| """Get all security rules for different IaC platforms""" | |
| return { | |
| "terraform": get_terraform_rules(), | |
| "cloudformation": get_cloudformation_rules(), | |
| "kubernetes": get_kubernetes_rules() | |
| } |