terragoat - TerraGoat is Bridgecrew's "Vulnerable by Design" T

项目说明

TerraGoat - Terraform Infrastructure

![Maintained by Bridgecrew.io]()
![Infrastructure Tests]()
![CIS Azure]()
![CIS GCP]()
![CIS AWS]()
![PCI]()
!Terraform
![slack-community]()

TerraGoat is Bridgecrew's " by Design" Terraform repository.
!Terragoat

TerraGoat is Bridgecrew's " by Design" Terraform repository.
TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud en.

Table of Contents

* Introduction
* Getting Started
* AWS
* Azure
* GCP
* Contributing
* Support

Introduction

TerraGoat was built to enable De design and implement a sustainable misconfiguration pre strategy. It can be used to test a policy-as-code framework like Bridgecrew & Checkov, inline-linters, pre-commit hooks or other code scanning methods.

TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure de best practices for cloud infrastructure.

Important notes

* Where to get help: the Bridgecrew Community Slack

Before you proceed please take a not of these warning:
> :warning: TerraGoat creates intentionally AWS resources into your account. DO NOT deploy TerraGoat in a production en or alongside any sensitive AWS resources.

Requirements

* Terraform 0.12
* aws cli
* azure cli

To prevent infrastructure from arriving to production see: Bridgecrew & checkov, the open source static analysis tool for infrastructure as code.

Getting started

AWS Setup

#### Installation (AWS)

You can deploy multiple TerraGoat stacks in a single AWS account using the parameter TF_.

#### Create an S3 Bucket backend to keep Terraform state

#### Apply TerraGoat (AWS)

#### Remo (AWS)

#### Creating multiple TerraGoat AWS stacks

#### Deleting multiple TerraGoat stacks (AWS)

Azure Setup

#### Installation (Azure)

You can deploy multiple TerraGoat stacks in a single Azure subscription using the parameter TF_.

#### Create an Azure Storage Account backend to keep Terraform state

#### Apply TerraGoat (Azure)

#### Remo (Azure)

GCP Setup

#### Installation (GCP)

You can deploy multiple TerraGoat stacks in a single GCP project using the parameter TF_.

#### Create a GCS backend to keep Terraform state

To use terraform, a Service Account and matching set of credentials are required.
If they do not exist, they must be manually created for the relevant project.
To create the Service Account:
1. Sign into your GCP project, go to IAM > Service Accounts.
2. Click the CREATE SERVICE ACCOUNT.
3. Give a name to your service account (for example - terragoat) and click CREATE.
4. Grant the Service Account the Project > Editor role and click CONTINUE.
5. Click DONE.

To create the credentials:
1. Sign into your GCP project, go to IAM > Service Accounts and click on the relevant Service Account.
2. Click ADD KEY > Create new key > JSON and click CREATE. This will create a .json file and download it to your computer.

We recommend saving the key with a nicer name than the auto-generated one (i.e. terragoat_credentials.json), and storing the resulting JSON file inside terraform/gcp directory of terragoat.
Once the credentials are set up, create the BE configuration as follows:

#### Apply TerraGoat (GCP)

#### Remo (GCP)

Bridgecrew's IaC herd of goats

* CfnGoat - by design Cloudformation template
* TerraGoat - by design Terraform stack
* CDKGoat - by design CDK application
* kustomizegoat - by design kustomize deployment

Contributing

Contribution is welcomed!

We would love to hear about more ideas on how to find infrastructure-as-code design patterns.

Support

Bridgecrew builds and maintains TerraGoat to encourage the adoption of policy-as-code.

If you need direct support you can contact us at .

Existing (Auto-Generated)

terraform scan results:

| | check_id | file | resource | check_name | guideline |
|-----|---------------|-------------------------------|---------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|
| 0 | CK | /alicloud/bucket.tf | alicloud_oss_bucket.bad_bucket | Ensure OSS bucket has enabled | |
| 1 | CK | /alicloud/bucket.tf | alicloud_oss_bucket.bad_bucket | Ensure the OSS bucket has access logging enabled | |
| 2 | CK | /alicloud/bucket.tf | alicloud_oss_bucket.bad_bucket | Ensure OSS bucket has transfer Acceleration enabled | |
| 3 | CK | /alicloud/bucket.tf | alicloud_oss_bucket.bad_bucket | Alibaba Cloud OSS bucket accessible to public | |
| 4 | CK | /alicloud/bucket.tf | alicloud_oss_bucket.bad_bucket | Ensure OSS bucket is encrypted with Customer Master Key | |
| 5 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure RDS instance has log_disconnections enabled | |
| 6 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure RDS instance has log_connections enabled | |
| 7 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure RDS instance is set to auto upgrade minor | |
| 8 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure RDS instance uses SSL | |
| 9 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure RDS instance auto upgrades for minor | |
| 10 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure RDS instance has log_duration enabled | |
| 11 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure database instance is not public | |
| 12 | CK | /alicloud/rds.tf | alicloud_db_instance.seeme | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | |
| 13 | CK | /alicloud/trail.tf | alicloud_actiontrail_trail.fail | Ensure Action Trail Logging for all regions | |
| 14 | CK | /alicloud/trail.tf | alicloud_actiontrail_trail.fail | Ensure Action Trail Logging for all events | |
| 15 | CK | /alicloud/trail.tf | alicloud_oss_bucket.trail | Ensure OSS bucket has enabled | |
| 16 | CK | /alicloud/trail.tf | alicloud_oss_bucket.trail | Ensure the OSS bucket has access logging enabled | |
| 17 | CK | /alicloud/trail.tf | alicloud_oss_bucket.trail | Ensure OSS bucket has transfer Acceleration enabled | |
| 18 | CK | /alicloud/trail.tf | alicloud_oss_bucket.trail | Ensure OSS bucket is encrypted with Customer Master Key | |
| 19 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure that RDS instances ha enabled | |
| 20 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure RDS database has IAM authentication enabled | |
| 21 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure all data stored in the RDS is securely encrypted at rest | |
| 22 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure DB instance gets all minor upgrades automatically | |
| 23 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure all data stored in RDS is not publicly accessible | |
| 24 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure that enhanced monitoring is enabled for Amazon RDS instances | |
| 25 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | |
| 26 | CK | /aws/db-app.tf | aws_db_instance.default | Ensure that RDS instances has backup policy | |
| 27 | CK | /aws/db-app.tf | aws_security_group.default | Ensure every security groups rule has a description | |
| 28 | CK | /aws/db-app.tf | aws_security_group_rule.ingress | Ensure every security groups rule has a description | |
| 29 | CK | /aws/db-app.tf | aws_security_group_rule.egress | Ensure every security groups rule has a description | |
| 30 | CK | /aws/db-app.tf | aws_instance.db_app | Ensure Instance Metadata Service 1 is not enabled | |
| 31 | CK | /aws/db-app.tf | aws_instance.db_app | Ensure that EC2 is EBS optimized | |
| 32 | CK | /aws/db-app.tf | aws_instance.db_app | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | |
| 33 | CK | /aws/db-app.tf | aws_instance.db_app | Ensure that detailed monitoring is enabled for EC2 instances | |
| 34 | CK | /aws/ec2.tf | aws_instance.web_host | Ensure Instance Metadata Service 1 is not enabled | |
| 35 | CK | /aws/ec2.tf | aws_instance.web_host | Ensure that EC2 is EBS optimized | |
| 36 | CK | /aws/ec2.tf | aws_instance.web_host | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | |
| 37 | CK | /aws/ec2.tf | aws_instance.web_host | Ensure no hard-coded secrets exist in EC2 user data | |
| 38 | CK | /aws/ec2.tf | aws_instance.web_host | Ensure that detailed monitoring is enabled for EC2 instances | |
| 39 | CK | /aws/ec2.tf | aws_ebs_.web_host_storage | Ensure all data stored in the EBS is securely encrypted | |
| 40 | CK | /aws/ec2.tf | aws_ebs_.web_host_storage | Ensure EBS is encrypted by KMS using a customer managed Key (CMK) | |
| 41 | CK | /aws/ec2.tf | aws_security_group.web-node | Ensure every security groups rule has a description | |
| 42 | CK | /aws/ec2.tf | aws_security_group.web-node | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | |
| 43 | CK | /aws/ec2.tf | aws_security_group.web-node | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | |
| 44 | CK | /aws/ec2.tf | aws_subnet.web_subnet | Ensure do not assign public IP by default | |
| 45 | CK | /aws/ec2.tf | aws_subnet.web_subnet2 | Ensure do not assign public IP by default | |
| 46 | CK | /aws/ecr.tf | aws_ecr_repository.repository | Ensure that ECR repositories are encrypted using KMS | |
| 47 | CK | /aws/ecr.tf | aws_ecr_repository.repository | Ensure ECR Image Tags are immutable | |
| 48 | CK | /aws/ecr.tf | aws_ecr_repository.repository | Ensure ECR image scanning on push is enabled | |
| 49 | CK | /aws/eks.tf | aws_subnet.eks_subnet1 | Ensure do not assign public IP by default | |
| 50 | CK | /aws/eks.tf | aws_subnet.eks_subnet2 | Ensure do not assign public IP by default | |
| 51 | CK | /aws/eks.tf | aws_eks_cluster.eks_cluster | Ensure Amazon EKS public endpoint disabled | |
| 52 | CK | /aws/eks.tf | aws_eks_cluster.eks_cluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | |
| 53 | CK | /aws/eks.tf | aws_eks_cluster.eks_cluster | Ensure Amazon EKS control plane logging enabled for all log types | |
| 54 | CK | /aws/eks.tf | aws_eks_cluster.eks_cluster | Ensure EKS Cluster has Secrets Encryption Enabled | |
| 55 | CK | /aws/elb.tf | aws_elb.weblb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | |
| 56 | CK | /aws/elb.tf | aws_elb.weblb | Ensure the ELB has access logging enabled | |
| 57 | CK | /aws/es.tf | aws_iam_policy_document.policy | Ensure IAM policies does not allow write access without constraints | |
| 58 | CK | /aws/es.tf | aws_iam_policy_document.policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | |
| 59 | CK | /aws/es.tf | aws_elasticsearch_domain.monitoring-framework | Ensure that Elasticsearch is configured inside a VPC | |
| 60 | CK | /aws/es.tf | aws_elasticsearch_domain.monitoring-framework | Ensure all data stored in the Elasticsearch is encrypted with a CMK | |
| 61 | CK | /aws/es.tf | aws_elasticsearch_domain.monitoring-framework | Ensure that Elasticsearch is not using the default Security Group | |
| 62 | CK | /aws/es.tf | aws_elasticsearch_domain.monitoring-framework | Elasticsearch domain is using an up to date TLS policy | |
| 63 | CK | /aws/es.tf | aws_elasticsearch_domain.monitoring-framework | Ensure Elasticsearch Domain Logging is enabled | |
| 64 | CK | /aws/es.tf | aws_elasticsearch_domain.monitoring-framework | Ensure all data stored in the Elasticsearch is securely encrypted at rest | |
| 65 | CK | /aws/kms.tf | aws_kms_key.logs_key | Ensure rotation for customer created CMKs is enabled | |
| 66 | CK | /aws/lambda.tf | aws_lambda_function.analysis_lambda | Ensure that AWS Lambda function is configured for function-le execution limit | |
| 67 | CK | /aws/lambda.tf | aws_lambda_function.analysis_lambda | Ensure no hard-coded secrets exist in lambda en | |
| 68 | CK | /aws/lambda.tf | aws_lambda_function.analysis_lambda | X-ray tracing is enabled for Lambda | |
| 69 | CK | /aws/lambda.tf | aws_lambda_function.analysis_lambda | Ensure that AWS Lambda function is configured inside a VPC | |
| 70 | CK | /aws/lambda.tf | aws_lambda_function.analysis_lambda | Check encryption settings for Lambda en | |
| 71 | CK | /aws/lambda.tf | aws_lambda_function.analysis_lambda | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | |
| 72 | CK | /aws/neptune.tf | aws_neptune_cluster.default | Ensure Neptune storage is securely encrypted | |
| 73 | CK | /aws/neptune.tf | aws_neptune_cluster.default | Ensure Neptune logging is enabled | |
| 74 | CK | /aws/pro.tf | aws.plain_text_access_keys_provider | Ensure no hard coded AWS access key and secret key exists in provider | |
| 75 | CK | /aws/rds.tf | aws_rds_cluster.app1-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 76 | CK | /aws/rds.tf | aws_rds_cluster.app1-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 77 | CK | /aws/rds.tf | aws_rds_cluster.app1-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 78 | CK | /aws/rds.tf | aws_rds_cluster.app1-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 79 | CK | /aws/rds.tf | aws_rds_cluster.app1-rds-cluster | Ensure that RDS instances has backup policy | |
| 80 | CK | /aws/rds.tf | aws_rds_cluster.app2-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 81 | CK | /aws/rds.tf | aws_rds_cluster.app2-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 82 | CK | /aws/rds.tf | aws_rds_cluster.app2-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 83 | CK | /aws/rds.tf | aws_rds_cluster.app2-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 84 | CK | /aws/rds.tf | aws_rds_cluster.app3-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 85 | CK | /aws/rds.tf | aws_rds_cluster.app3-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 86 | CK | /aws/rds.tf | aws_rds_cluster.app3-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 87 | CK | /aws/rds.tf | aws_rds_cluster.app3-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 88 | CK | /aws/rds.tf | aws_rds_cluster.app4-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 89 | CK | /aws/rds.tf | aws_rds_cluster.app4-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 90 | CK | /aws/rds.tf | aws_rds_cluster.app4-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 91 | CK | /aws/rds.tf | aws_rds_cluster.app4-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 92 | CK | /aws/rds.tf | aws_rds_cluster.app5-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 93 | CK | /aws/rds.tf | aws_rds_cluster.app5-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 94 | CK | /aws/rds.tf | aws_rds_cluster.app5-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 95 | CK | /aws/rds.tf | aws_rds_cluster.app5-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 96 | CK | /aws/rds.tf | aws_rds_cluster.app6-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 97 | CK | /aws/rds.tf | aws_rds_cluster.app6-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 98 | CK | /aws/rds.tf | aws_rds_cluster.app6-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 99 | CK | /aws/rds.tf | aws_rds_cluster.app6-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 100 | CK | /aws/rds.tf | aws_rds_cluster.app7-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 101 | CK | /aws/rds.tf | aws_rds_cluster.app7-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 102 | CK | /aws/rds.tf | aws_rds_cluster.app7-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 103 | CK | /aws/rds.tf | aws_rds_cluster.app7-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 104 | CK | /aws/rds.tf | aws_rds_cluster.app8-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 105 | CK | /aws/rds.tf | aws_rds_cluster.app8-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 106 | CK | /aws/rds.tf | aws_rds_cluster.app8-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 107 | CK | /aws/rds.tf | aws_rds_cluster.app8-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 108 | CK | /aws/rds.tf | aws_rds_cluster.app9-rds-cluster | Ensure that an Amazon RDS Clusters have AWS Identity and Access Management (IAM) authentication enabled | |
| 109 | CK | /aws/rds.tf | aws_rds_cluster.app9-rds-cluster | Ensure that RDS clusters ha protection enabled | |
| 110 | CK | /aws/rds.tf | aws_rds_cluster.app9-rds-cluster | Ensure all data stored in Aurora is securely encrypted at rest | |
| 111 | CK | /aws/rds.tf | aws_rds_cluster.app9-rds-cluster | Ensure RDS cluster has IAM authentication enabled | |
| 112 | CK | /aws/s3.tf | aws_s3_bucket_object.data_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | |
| 113 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure that AKS uses Azure Policies Add-on | |
| 114 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure Kubernetes Dashboard is disabled | |
| 115 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure AKS logging to Azure Monitoring is Configured | |
| 116 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure that AKS uses disk encryption set | |
| 117 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure that AKS enables private clusters | |
| 118 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure AKS local admin account is disabled | |
| 119 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure AKS cluster has Network Policy configured | |
| 120 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure AKS has an API Ser IP Ranges enabled | |
| 121 | CK | /azure/aks.tf | azurerm_kubernetes_cluster.k8s_cluster | Ensure RBAC is enabled on AKS clusters | |
| 122 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure web app is using the latest of TLS encryption | |
| 123 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure FTP deployments are disabled | |
| 124 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that 'HTTP ' is the latest if used to run the web app | |
| 125 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that app services use Azure Files | |
| 126 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure App Service Authentication is set on Azure App Service | |
| 127 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that Managed identity provider is enabled for app services | |
| 128 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that 'Net Framework' is the latest, if used as a part of the web app | |
| 129 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that App service enables detailed error messages | |
| 130 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that App service enables HTTP logging | |
| 131 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | |
| 132 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that Register with Azure Acti is enabled on App Service | |
| 133 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure that App service enables failed request tracing | |
| 134 | CK | /azure/app_service.tf | azurerm_app_service.app-service1 | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | |
| 135 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure FTP deployments are disabled | |
| 136 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that 'HTTP ' is the latest if used to run the web app | |
| 137 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that app services use Azure Files | |
| 138 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure App Service Authentication is set on Azure App Service | |
| 139 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that Managed identity provider is enabled for app services | |
| 140 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that 'Net Framework' is the latest, if used as a part of the web app | |
| 141 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that App service enables detailed error messages | |
| 142 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that App service enables HTTP logging | |
| 143 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | |
| 144 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that Register with Azure Acti is enabled on App Service | |
| 145 | CK | /azure/app_service.tf | azurerm_app_service.app-service2 | Ensure that App service enables failed request tracing | |
| 146 | CK | /azure/instance.tf | azurerm_linux_.linux_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | |
| 147 | CK | /azure/instance.tf | azurerm_linux_.linux_machine | Ensure Machine Extensions are not Installed | |
| 148 | CK | /azure/instance.tf | azurerm_linux_.linux_machine | Ensure that machine does not enable password authentication | |
| 149 | CK | /azure/instance.tf | azurerm_windows_.windows_machine | Ensure Windows encryption | |
| 150 | CK | /azure/instance.tf | azurerm_windows_.windows_machine | Ensure Machine Extensions are not Installed | |
| 151 | CK | /azure/key_vault.tf | azurerm_key_vault.example | Ensure that key vault allows firewall rules settings | |
| 152 | CK | /azure/key_vault.tf | azurerm_key_vault.example | Ensure the key vault is reco | |
| 153 | CK | /azure/key_vault.tf | azurerm_key_vault.example | Ensure that key vault enables purge protection | |
| 154 | CK | /azure/key_vault.tf | azurerm_key_.generated | Ensure that key vault key is backed by HSM | |
| 155 | CK | /azure/key_vault.tf | azurerm_key_.generated | Ensure that the expiration date is set on all keys | |
| 156 | CK | /azure/key_vault.tf | azurerm_key_.secret | Ensure that key vault secrets have "content_type" set | |
| 157 | CK | /azure/key_vault.tf | azurerm_key_.secret | Ensure that the expiration date is set on all secrets | |
| 158 | CK | /azure/logging.tf | azurerm_monitor_log_profile.logging_profile | Ensure audit profile captures all the acti | |
| 159 | CK | /azure/logging.tf | azurerm_monitor_log_profile.logging_profile | Ensure that Activity Log Retention is set 365 days or greater | |
| 160 | CK | /azure/mssql.tf | azurerm_storage_account.security_storage_account | Ensure default network access rule for Storage Accounts is set to deny | |
| 161 | CK | /azure/mssql.tf | azurerm_storage_account.security_storage_account | Ensure Storage logging is enabled for Queue service for read, write and delete requests | |
| 162 | CK | /azure/mssql.tf | azurerm_storage_account.security_storage_account | Ensure Storage Account is using the latest of TLS encryption | |
| 163 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure MSSQL is using the latest of TLS encryption | |
| 164 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that SQL ser public network access | |
| 165 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure MSSQL is using the latest of TLS encryption | |
| 166 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that SQL ser public network access | |
| 167 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure MSSQL is using the latest of TLS encryption | |
| 168 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that SQL ser public network access | |
| 169 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure MSSQL is using the latest of TLS encryption | |
| 170 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that SQL ser public network access | |
| 171 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure MSSQL is using the latest of TLS encryption | |
| 172 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that SQL ser public network access | |
| 173 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure MSSQL is using the latest of TLS encryption | |
| 174 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that SQL ser public network access | |
| 175 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure MSSQL is using the latest of TLS encryption | |
| 176 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that SQL ser public network access | |
| 177 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy1 | Ensure that 'Threat Detection types' is set to 'All' | |
| 178 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy1 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 179 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy2 | Ensure that 'Threat Detection types' is set to 'All' | |
| 180 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy2 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 181 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy3 | Ensure that 'Threat Detection types' is set to 'All' | |
| 182 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy3 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 183 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy4 | Ensure that 'Threat Detection types' is set to 'All' | |
| 184 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy4 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 185 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy5 | Ensure that 'Threat Detection types' is set to 'All' | |
| 186 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy5 | Ensure that 'Send Alerts To' is enabled for MSSQL servers | |
| 187 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy5 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 188 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy6 | Ensure that 'Threat Detection types' is set to 'All' | |
| 189 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy6 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 190 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy7 | Ensure that 'Threat Detection types' is set to 'All' | |
| 191 | CK | /azure/mssql.tf | azurerm_mssql_sery.alertpolicy7 | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 192 | CK | /azure/networking.tf | azurerm_network_security_group.bad_sg | Ensure that SSH access is restricted from the internet | |
| 193 | CK | /azure/networking.tf | azurerm_network_security_group.bad_sg | Ensure that RDP access is restricted from the internet | |
| 194 | CK | /azure/networking.tf | azurerm_network_watcher_flow_log.flow_log | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | |
| 195 | CK | /azure/roles.tf | azurerm_role_definition.example | Ensure that no custom subscription owner roles are created | |
| 196 | CK | /azure/security_center.tf | azurerm_security_center_subscription_pricing.pricing | Ensure that standard pricing tier is selected | |
| 197 | CK | /azure/security_center.tf | azurerm_security_center_contact.contact | Ensure that security contact 'Phone number' is set | |
| 198 | CK | /azure/security_center.tf | azurerm_security_center_contact.contact | Ensure that 'Send email notification for high se alerts' is set to 'On' | |
| 199 | CK | /azure/security_center.tf | azurerm_security_center_contact.contact | Ensure that 'Send email notification for high se alerts' is set to 'On' | |
| 200 | CK | /azure/sql.tf | azurerm_mssql_sery.example | Ensure that 'Threat Detection types' is set to 'All' | |
| 201 | CK | /azure/sql.tf | azurerm_mssql_sery.example | Ensure that 'Send Alerts To' is enabled for MSSQL servers | |
| 202 | CK | /azure/sql.tf | azurerm_mssql_sery.example | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | |
| 203 | CK | /azure/sql.tf | azurerm_mysql_ser | Ensure that My SQL ser Threat detection policy | |
| 204 | CK | /azure/sql.tf | azurerm_mysql_ser | Ensure that My SQL ser geo-redundant backups | |
| 205 | CK | /azure/sql.tf | azurerm_mysql_ser | Ensure 'public network access enabled' is set to 'False' for mySQL servers | |
| 206 | CK | /azure/sql.tf | azurerm_mysql_ser | Ensure MySQL is using the latest of TLS encryption | |
| 207 | CK | /azure/sql.tf | azurerm_mysql_ser | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | |
| 208 | CK | /azure/sql.tf | azurerm_postgresql_ser | Ensure PostgreSQL is using the latest of TLS encryption | |
| 209 | CK | /azure/sql.tf | azurerm_postgresql_ser | Ensure that PostgreSQL ser infrastructure encryption | |
| 210 | CK | /azure/sql.tf | azurerm_postgresql_ser | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | |
| 211 | CK | /azure/sql.tf | azurerm_postgresql_ser | Ensure that PostgreSQL ser Threat detection policy | |
| 212 | CK | /azure/sql.tf | azurerm_postgresql_ser | Ensure that PostgreSQL ser geo-redundant backups | |
| 213 | CK | /azure/sql.tf | azurerm_postgresql_ser | Ensure that PostgreSQL ser public network access | |
| 214 | CK | /azure/sql.tf | azurerm_postgresql_configuration.thrtottling_config | Ensure ser 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | |
| 215 | CK | /azure/sql.tf | azurerm_postgresql_configuration.example | Ensure ser 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | |
| 216 | CK | /azure/storage.tf | azurerm_managed_disk.example | Ensure Azure managed disk has encryption enabled | |
| 217 | CK | /azure/storage.tf | azurerm_managed_disk.example | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | |
| 218 | CK | /azure/storage.tf | azurerm_storage_account.example | Ensure default network access rule for Storage Accounts is set to deny | |
| 219 | CK | /azure/storage.tf | azurerm_storage_account.example | Ensure that 'Secure transfer required' is set to 'Enabled' | |
| 220 | CK | /azure/storage.tf | azurerm_storage_account.example | Ensure Storage logging is enabled for Queue service for read, write and delete requests | |
| 221 | CK | /azure/storage.tf | azurerm_storage_account.example | Ensure Storage Account is using the latest of TLS encryption | |
| 222 | CK | /azure/storage.tf | azurerm_storage_account_network_rules.test | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | |
| 223 | CK | /gcp/big_data.tf | google_sql_database_instance.master_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | |
| 224 | CK | /gcp/big_data.tf | google_sql_database_instance.master_instance | Ensure that Cloud SQL database Instances are not open to the world | |
| 225 | CK | /gcp/big_data.tf | google_sql_database_instance.master_instance | Ensure SQL database is using latest Major | |
| 226 | CK | /gcp/big_data.tf | google_sql_database_instance.master_instance | Ensure Cloud SQL database does not ha IP | |
| 227 | CK | /gcp/big_data.tf | google_sql_database_instance.master_instance | Ensure all Cloud SQL database instance ha configuration enabled | |
| 228 | CK | /gcp/big_data.tf | google_bigquery_dataset.dataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | |
| 229 | CK | /gcp/big_data.tf | google_bigquery_dataset.dataset | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | |
| 230 | CK | /gcp/gcs.tf | google_storage_bucket.terragoat_website | Bucket should log access | |
| 231 | CK | /gcp/gcs.tf | google_storage_bucket.terragoat_website | Ensure Cloud storage has enabled | |
| 232 | CK | /gcp/gcs.tf | google_storage_bucket.terragoat_website | Ensure that Cloud Storage buckets ha bucket-le enabled | |
| 233 | CK | /gcp/gcs.tf | google_storage_bucket_iam_binding.allow_public_read | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | |
| 234 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure the GKE Release Channel is set | |
| 235 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure the GKE Metadata Server is Enabled | |
| 236 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure legacy Compute Engine instance metadata APIs are Disabled | |
| 237 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure GKE basic auth is disabled | |
| 238 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure Kubernetes Clusters are configured with Labels | |
| 239 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure use of Binary Authorization | |
| 240 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Enable VPC Flow Logs and Intranode | |
| 241 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure Kubernetes Cluster is created with Private cluster enabled | |
| 242 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure Stackdri is set to Enabled on Kubernetes Engine Clusters | |
| 243 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure GKE Control Plane is not public | |
| 244 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure clusters are created with Private Nodes | |
| 245 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | |
| 246 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | |
| 247 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Manage Kubernetes RBAC users with Google Groups for GKE | |
| 248 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | |
| 249 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | |
| 250 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | |
| 251 | CK | /gcp/gke.tf | google_container_cluster.workload_cluster | Ensure Stackdri is set to Enabled on Kubernetes Engine Clusters | |
| 252 | CK | /gcp/gke.tf | google_container_node_pool.custom_node_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | |
| 253 | CK | /gcp/gke.tf | google_container_node_pool.custom_node_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | |
| 254 | CK | /gcp/gke.tf | google_container_node_pool.custom_node_pool | Ensure the GKE Metadata Server is Enabled | |
| 255 | CK | /gcp/gke.tf | google_container_node_pool.custom_node_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | |
| 256 | CK | /gcp/gke.tf | google_container_node_pool.custom_node_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | |
| 257 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | |
| 258 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure 'Enable connecting to serial ports' is not enabled for | |
| 259 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure that Compute instances do not ha IP addresses | |
| 260 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure that no instance in the project o the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | |
| 261 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure that instances are not configured to use the default service account | |
| 262 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure that IP forwarding is not enabled on Instances | |
| 263 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure 'Block Project-wide SSH keys' is enabled for | |
| 264 | CK | /gcp/instances.tf | google_compute_instance.server | Ensure Compute instances are launched with Shielded | |
| 265 | CK | /gcp/instances.tf | google_compute_disk.unencrypted_disk | Ensure for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | |
| 266 | CK | /gcp/networks.tf | google_compute_subnetwork.public-subnetwork | Ensure that pri is enabled for Subnet | |
| 267 | CK | /gcp/networks.tf | google_compute_subnetwork.public-subnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a | |
| 268 | CK | /gcp/networks.tf | google_compute_subnetwork.public-subnetwork | Ensure that Private google access is enabled for IPV6 | |
| 269 | CK | /gcp/networks.tf | google_compute_firewall.allow_all | Ensure Google compute firewall ingress does not allow unrestricted mysql access | |
| 270 | CK | /gcp/networks.tf | google_compute_firewall.allow_all | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | |
| 271 | CK | /gcp/networks.tf | google_compute_firewall.allow_all | Ensure Google compute firewall ingress does not allow on ftp port | |
| 272 | CK | /gcp/networks.tf | google_compute_firewall.allow_all | Ensure Google compute firewall ingress does not allow unrestricted rdp access | |
| 273 | CK | /gcp/networks.tf | google_compute_firewall.allow_all | Ensure Google compute firewall ingress does not allow unrestricted FTP access | |
| 274 | CK | /gcp/networks.tf | google_compute_firewall.allow_all | Ensure Google compute firewall ingress does not allow unrestricted ssh access | |
| 275 | CK | /oracle/bucket.tf | oci_objectstorage_bucket.secretsquirrel | Ensure OCI Object Storage is encrypted with Customer Managed Key | |
| 276 | CK | /oracle/bucket.tf | oci_objectstorage_bucket.secretsquirrel | Ensure OCI Object Storage has enabled | |
| 277 | CK | /oracle/bucket.tf | oci_objectstorage_bucket.secretsquirrel | Ensure OCI Object Storage bucket can emit object events | |
| 278 | CK | /oracle/bucket.tf | oci_objectstorage_bucket.secretsquirrel | Ensure OCI Object Storage is not Public | |
| 279 | CK | /aws/eks.tf | aws_ | Ensure the default security group of every all traffic | |
| 280 | CK | /aws/ec2.tf | aws_ | Ensure the default security group of every all traffic | |
| 281 | CK | /aws/rds.tf | aws_rds_cluster.app8-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 282 | CK | /aws/rds.tf | aws_rds_cluster.app4-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 283 | CK | /aws/rds.tf | aws_rds_cluster.app7-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 284 | CK | /aws/rds.tf | aws_rds_cluster.app1-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 285 | CK | /aws/rds.tf | aws_rds_cluster.app3-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 286 | CK | /aws/rds.tf | aws_rds_cluster.app9-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 287 | CK | /aws/rds.tf | aws_rds_cluster.app5-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 288 | CK | /aws/rds.tf | aws_rds_cluster.app6-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 289 | CK | /aws/rds.tf | aws_rds_cluster.app2-rds-cluster | Ensure that RDS clusters has backup plan of AWS Backup | |
| 290 | CK | /aws/s3.tf | aws_s3_bucket.financials | Ensure that S3 buckets are encrypted with KMS by default | |
| 291 | CK | /aws/s3.tf | aws_s3_bucket.data_science | Ensure that S3 buckets are encrypted with KMS by default | |
| 292 | CK | /aws/s3.tf | aws_s3_bucket.data | Ensure that S3 buckets are encrypted with KMS by default | |
| 293 | CK | /aws/ec2.tf | aws_s3_bucket.flowbucket | Ensure that S3 buckets are encrypted with KMS by default | |
| 294 | CK | /aws/s3.tf | aws_s3_bucket.operations | Ensure that S3 buckets are encrypted with KMS by default | |
| 295 | CK | /aws/s3.tf | aws_s3_bucket.financials | Ensure the S3 bucket has access logging enabled | |
| 296 | CK | /aws/s3.tf | aws_s3_bucket.data | Ensure the S3 bucket has access logging enabled | |
| 297 | CK | /aws/ec2.tf | aws_s3_bucket.flowbucket | Ensure the S3 bucket has access logging enabled | |
| 298 | CK | /aws/s3.tf | aws_s3_bucket.operations | Ensure the S3 bucket has access logging enabled | |
| 299 | CK | /aws/s3.tf | aws_s3_bucket.logs | Ensure the S3 bucket has access logging enabled | |
| 300 | CK | /aws/eks.tf | aws_ | Ensure VPC flow logging is enabled in all VPCs | |
| 301 | CK | /aws/ec2.tf | aws_ebs_.web_host_storage | Ensure that only encrypted EBS are attached to EC2 instances | |
| 302 | CK | /aws/s3.tf | aws_s3_bucket.financials | Ensure that S3 bucket has a Public Access block | |
| 303 | CK | /aws/s3.tf | aws_s3_bucket.data_science | Ensure that S3 bucket has a Public Access block | |
| 304 | CK | /aws/s3.tf | aws_s3_bucket.data | Ensure that S3 bucket has a Public Access block | |
| 305 | CK | /aws/ec2.tf | aws_s3_bucket.flowbucket | Ensure that S3 bucket has a Public Access block | |
| 306 | CK | /aws/s3.tf | aws_s3_bucket.operations | Ensure that S3 bucket has a Public Access block | |
| 307 | CK | /aws/s3.tf | aws_s3_bucket.logs | Ensure that S3 bucket has a Public Access block | |
| 308 | CK | /aws/s3.tf | aws_s3_bucket.financials | Ensure all data stored in the S3 bucket ha enabled | |
| 309 | CK | /aws/s3.tf | aws_s3_bucket.data | Ensure all data stored in the S3 bucket ha enabled | |
| 310 | CK | /aws/ec2.tf | aws_s3_bucket.flowbucket | Ensure all data stored in the S3 bucket ha enabled | |
| 311 | CK | /azure/sql.tf | azurerm_sql_ser | Ensure that Azure Acti Admin is configured | |
| 312 | CK | /azure/storage.tf | azurerm_storage_account.example | Ensure storage for critical data are encrypted with Customer Managed Key | |
| 313 | CK | /azure/mssql.tf | azurerm_storage_account.security_storage_account | Ensure storage for critical data are encrypted with Customer Managed Key | |
| 314 | CK | /azure/sql.tf | azurerm_mysql_ser | Ensure that MySQL ser customer-managed key for encryption | |
| 315 | CK | /azure/application_gateway.tf | azurerm_application_gateway.network | Ensure that Application Gateway enables WAF | |
| 316 | CK | /aws/s3.tf | aws_s3_bucket.financials | Ensure that S3 bucket has cross-region replication enabled | |
| 317 | CK | /aws/s3.tf | aws_s3_bucket.data_science | Ensure that S3 bucket has cross-region replication enabled | |
| 318 | CK | /aws/s3.tf | aws_s3_bucket.data | Ensure that S3 bucket has cross-region replication enabled | |
| 319 | CK | /aws/ec2.tf | aws_s3_bucket.flowbucket | Ensure that S3 bucket has cross-region replication enabled | |
| 320 | CK | /aws/s3.tf | aws_s3_bucket.operations | Ensure that S3 bucket has cross-region replication enabled | |
| 321 | CK | /aws/s3.tf | aws_s3_bucket.logs | Ensure that S3 bucket has cross-region replication enabled | |
| 322 | CK | /azure/storage.tf | azurerm_storage_account.example | Ensure that Storage Accounts use customer-managed key for encryption | |
| 323 | CK | /azure/mssql.tf | azurerm_storage_account.security_storage_account | Ensure that Storage Accounts use customer-managed key for encryption | |
| 324 | CK | /aws/s3.tf | aws_s3_bucket.financials | Ensure all data stored in the S3 bucket is securely encrypted at rest | |
| 325 | CK | /aws/s3.tf | aws_s3_bucket.data_science | Ensure all data stored in the S3 bucket is securely encrypted at rest | |
| 326 | CK | /aws/s3.tf | aws_s3_bucket.data | Ensure all data stored in the S3 bucket is securely encrypted at rest | |
| 327 | CK | /aws/ec2.tf | aws_s3_bucket.flowbucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | |
| 328 | CK | /aws/s3.tf | aws_s3_bucket.operations | Ensure all data stored in the S3 bucket is securely encrypted at rest | |
| 329 | CK | /azure/sql.tf | azurerm_sql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 330 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 331 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 332 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 333 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 334 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 335 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 336 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | |
| 337 | CK | /azure/sql.tf | azurerm_sql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |
| 338 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |
| 339 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |
| 340 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |
| 341 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |
| 342 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |
| 343 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |
| 344 | CK | /azure/mssql.tf | azurerm_mssql_ser | Ensure that 'Auditing' is set to 'On' for SQL servers | |

---

dockerfile scan results:

| | check_id | file | resource | check_name | guideline |
|----|--------------|---------------------------|----------------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|
| 0 | CK | /aws/resources/Dockerfile | /aws/resources/Dockerfile. | Ensure that a user for the container has been created | |
| 1 | CK | /aws/resources/Dockerfile | /aws/resources/Dockerfile. | Ensure that HEALTHCHECK instructions have been added to container images | |

---

secrets scan results:

| | check_id | file | resource | check_name | guideline |
|----|--------------|-------------------|------------------------------------------|----------------------------|-----------------------------------------------|
| 0 | CK | /aws/lambda.tf | 25910f981e85ca04baf359199dd0bd4a3ae738b6 | AWS Access Key | |
| 1 | CK | /aws/lambda.tf | d70eab08607a4d05faa2d0d6647206599e9abc65 | Base64 High Entropy String | |
| 2 | CK | /aws/pro.tf | 25910f981e85ca04baf359199dd0bd4a3ae738b6 | AWS Access Key | |
| 3 | CK | /aws/pro.tf | d70eab08607a4d05faa2d0d6647206599e9abc65 | Base64 High Entropy String | |
| 4 | CK | /azure/sql.tf | a57ae0fe47084bc8a05f69f3f8083896f8b437b0 | Base64 High Entropy String | |

---

项目信息

开发语言：HCL

Star 数：1307

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。