You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
5
+
6
+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
7
+
8
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Tflint rules for CIS compliance checks. These rules work in addition to the recommendations from [Gruntwork's CIS Service Catalog](https://github.com/gruntwork-io/terraform-aws-cis-service-catalog).
3
7
4
-
This is a template repository for building a custom ruleset. You can create a plugin repository from "Use this template". See also [Writing Plugins](https://github.com/terraform-linters/tflint/blob/master/docs/developer-guide/plugins.md).
5
8
6
9
## Requirements
7
10
@@ -10,37 +13,50 @@ This is a template repository for building a custom ruleset. You can create a pl
10
13
11
14
## Installation
12
15
13
-
TODO: This template repository does not contain release binaries, so this installation will not work. Please rewrite for your repository. See the "Building the plugin" section to get this template ruleset working.
14
-
15
16
You can install the plugin with `tflint --init`. Declare a config in `.tflint.hcl` as follows:
| aws_security_group_rule_invalid_cidr_block | Ensure that SG rules do not allow public access to remote administration ports |ERROR|✔| 5.2 and 5.3 |
42
32
43
-
## Building the plugin
33
+
## Terragrunt
34
+
35
+
It's recommended that these rules are added into your Terragrunt project, using [Before Hooks or After Hooks](https://terragrunt.gruntwork.io/docs/features/hooks/#tflint-hook).
36
+
37
+
```hcl
38
+
terraform {
39
+
before_hook "before_hook" {
40
+
commands = ["apply", "plan"]
41
+
execute = ["tflint"]
42
+
}
43
+
}
44
+
```
45
+
46
+
In the root of the Terragrunt project, add a `.tflint.hcl` file:
Clone the repository locally and run the following command:
46
62
@@ -58,9 +74,24 @@ You can run the built plugin like the following:
58
74
59
75
```
60
76
$ cat << EOS > .tflint.hcl
61
-
plugin "template" {
77
+
plugin "aws-cis" {
62
78
enabled = true
63
79
}
64
80
EOS
65
81
$ tflint
66
82
```
83
+
84
+
### Manual release
85
+
86
+
In order to release the binaries, this project uses [goreleaser](https://goreleaser.com/) ([install instructions](https://goreleaser.com/install/)).
87
+
88
+
Export the variable `GPG_FINGERPRINT` in order to sign the release, and `GITHUB_TOKEN` so the binaries can be uploaded to GitHub. The release should run locally from the tag that will have the release.
Disallow rules that allow `0.0.0.0/0` or `::/0` access on remote access control ports (22 and 3389).
4
+
5
+
## Example
6
+
7
+
```hcl
8
+
resource "aws_security_group_rule" "rule" {
9
+
from_port = 22
10
+
to_port = 22
11
+
protocol = "tcp"
12
+
type = "ingress"
13
+
cidr_blocks = ["0.0.0.0/0", "10.0.0.0/16"]
14
+
}
15
+
```
16
+
17
+
```
18
+
1 issue(s) found:
19
+
20
+
Error: cidr_blocks can not contain '0.0.0.0/0' when allowing 'ingress' access to ports [22 3389] (aws_security_group_rule_invalid_cidr_block)
21
+
22
+
```
23
+
24
+
## Why
25
+
26
+
CIS AWS Benckmark has two recommendations regarding Security Group's CIDR blocks:
27
+
- 5.2 ensures no security groups allow ingress from 0.0.0.0/0 to remote server administration ports
28
+
- 5.3 ensures no security groups allow ingress from ::/0 to remote server administration ports
29
+
30
+
## How To Fix
31
+
32
+
Update `cidr_blocks` and/or `ipv6_cidr_blocks` to not allow access to the remote access ports, or update the port values to not contain the remote access ones.
0 commit comments