|
1 | 1 | # Rule Details |
2 | 2 |
|
| 3 | +## aws_meta_hardcoded |
| 4 | + |
| 5 | +This is a comprehensive rule that checks ALL AWS resources for hardcoded regions and partitions in ARN values. It works by walking through all expressions in your Terraform files and detecting any string that looks like an ARN with hardcoded values. |
| 6 | + |
| 7 | +This rule covers resource types including: |
| 8 | +- Lambda (permissions, event source mappings, functions) |
| 9 | +- SNS/SQS (subscriptions, queue policies) |
| 10 | +- CloudWatch (event targets, log subscriptions, alarms) |
| 11 | +- API Gateway (integrations, authorizers) |
| 12 | +- KMS (grants, aliases, keys) |
| 13 | +- Secrets Manager (rotations, policies) |
| 14 | +- ECS (services, task definitions) |
| 15 | +- RDS (instances, event subscriptions, clusters) |
| 16 | +- S3 (notifications, policies, access points) |
| 17 | +- And many more... |
| 18 | + |
| 19 | +**Example violations:** |
| 20 | +```hcl |
| 21 | +resource "aws_lambda_permission" "test" { |
| 22 | + source_arn = "arn:aws:s3:us-east-1:123456789012:bucket/my-bucket" # ❌ Hardcoded region and partition |
| 23 | +} |
| 24 | +
|
| 25 | +resource "aws_kms_grant" "test" { |
| 26 | + key_id = "arn:aws:kms:eu-west-1:123456789012:key/12345678-1234-1234-1234-123456789012" # ❌ Hardcoded region and partition |
| 27 | +} |
| 28 | +``` |
| 29 | + |
| 30 | +**Recommended fixes:** |
| 31 | +```hcl |
| 32 | +data "aws_region" "current" {} |
| 33 | +data "aws_partition" "current" {} |
| 34 | +
|
| 35 | +resource "aws_lambda_permission" "test" { |
| 36 | + source_arn = "arn:${data.aws_partition.current.partition}:s3:${data.aws_region.current.name}:123456789012:bucket/my-bucket" # ✅ Dynamic |
| 37 | +} |
| 38 | +
|
| 39 | +resource "aws_kms_grant" "test" { |
| 40 | + key_id = "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.name}:123456789012:key/12345678-1234-1234-1234-123456789012" # ✅ Dynamic |
| 41 | +} |
| 42 | +``` |
| 43 | + |
3 | 44 | ## aws_iam_role_policy_hardcoded_region |
4 | 45 |
|
5 | 46 | This rule checks `aws_iam_role_policy` resources for hardcoded AWS regions in policy documents. It examines both JSON policy strings and structured policy documents to detect: |
@@ -151,43 +192,4 @@ provider "aws" { |
151 | 192 | } |
152 | 193 | ``` |
153 | 194 |
|
154 | | -## aws_arn_hardcoded |
155 | | - |
156 | | -This is a comprehensive rule that checks ALL AWS resources for hardcoded regions and partitions in ARN values. It works by walking through all expressions in your Terraform files and detecting any string that looks like an ARN with hardcoded values. |
157 | | - |
158 | | -This rule covers resource types including: |
159 | | -- Lambda (permissions, event source mappings, functions) |
160 | | -- SNS/SQS (subscriptions, queue policies) |
161 | | -- CloudWatch (event targets, log subscriptions, alarms) |
162 | | -- API Gateway (integrations, authorizers) |
163 | | -- KMS (grants, aliases, keys) |
164 | | -- Secrets Manager (rotations, policies) |
165 | | -- ECS (services, task definitions) |
166 | | -- RDS (instances, event subscriptions, clusters) |
167 | | -- S3 (notifications, policies, access points) |
168 | | -- And many more... |
169 | 195 |
|
170 | | -**Example violations:** |
171 | | -```hcl |
172 | | -resource "aws_lambda_permission" "test" { |
173 | | - source_arn = "arn:aws:s3:us-east-1:123456789012:bucket/my-bucket" # ❌ Hardcoded region and partition |
174 | | -} |
175 | | -
|
176 | | -resource "aws_kms_grant" "test" { |
177 | | - key_id = "arn:aws:kms:eu-west-1:123456789012:key/12345678-1234-1234-1234-123456789012" # ❌ Hardcoded region and partition |
178 | | -} |
179 | | -``` |
180 | | - |
181 | | -**Recommended fixes:** |
182 | | -```hcl |
183 | | -data "aws_region" "current" {} |
184 | | -data "aws_partition" "current" {} |
185 | | -
|
186 | | -resource "aws_lambda_permission" "test" { |
187 | | - source_arn = "arn:${data.aws_partition.current.partition}:s3:${data.aws_region.current.name}:123456789012:bucket/my-bucket" # ✅ Dynamic |
188 | | -} |
189 | | -
|
190 | | -resource "aws_kms_grant" "test" { |
191 | | - key_id = "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.name}:123456789012:key/12345678-1234-1234-1234-123456789012" # ✅ Dynamic |
192 | | -} |
193 | | -``` |
|
0 commit comments