Possible Security Problems

[ctindall]

Hey there! I noticed some possible problems in some code in this repo. A quick summary of a few of them is below, but let me know if you're interested in seeing a full report or talking about cloud security in general.

---

severity: serious

filename: ./JumpHost/template.json

line number(s): [241]

resource(s):

Missing egress rule means all traffic is allowed outbound. Make this explicit if it is desired configuration

---

severity: warning

filename: ./VPC/aws-scca-vdss-stack-singleAZ.json

line number(s): [140]

resource(s):

EC2 Subnet should not have MapPublicIpOnLaunch set to true

---

severity: warning

filename: ./VPC/aws-scca-vdss-stack-singleAZ.template.json

line number(s): [122]

resource(s):

EC2 Subnet should not have MapPublicIpOnLaunch set to true

---

severity: warning

filename: ./VPC/route-table-update-post-EC2-builds.json

line number(s): [163]

resource(s):

IAM role should not allow * resource on its permissions policy

---

severity: warning

filename: ./JumpHost/template.json

line number(s): [241]

resource(s):

Security Groups found with ingress cidr that is not /32

---

severity: warning

filename: ./JumpHost/template.json

line number(s): [241]

resource(s):

Security Groups found with cidr open to world on ingress. This should never be true on instance. Permissible on ELB

---

severity: warning

filename: ./JumpHost/template.json

line number(s): [241]

resource(s):

Security Groups found ingress with port range instead of just a single port

[mikeoleary]

Thanks for these items. We will review and add this to our backlog and address. Updates to come.

[mikeoleary]

Thanks for submitting. Some updates:

• I've submitted PR Incremental security updates #84 to address many of these issues.
• I've created issue Lambda functions currently may require publicly accessible mgmt address #83 to track the progress of removing inbound access from the public internet.
• The IAM role is unchanged, for now. Long term, we would like to perform post-deployment config in a different tool.
  I'll close out this issue now, please reach out if you have more to submit.