Sample

main.tf

@@ -4,16 +4,16 @@ provider "aws" {
   skip_credentials_validation = true
   skip_requesting_account_id  = true
   skip_metadata_api_check     = true
-  access_key                  = "mock_access_key"
-  secret_key                  = "mock_secret_key"
+  #access_key                  = "mock_access_key"
+  #secret_key                  = "mock_secret_key"
 }
 
 resource "aws_iam_account_password_policy" "strict" {
-  minimum_password_length = 8
-  #require_lowercase_characters   = true
-  #require_numbers                = true
-  #require_uppercase_characters   = true
-  #require_symbols                = true
+  minimum_password_length = 16
+  require_lowercase_characters   = true
+  require_numbers                = true
+  require_uppercase_characters   = true
+  require_symbols                = true
   #allow_users_to_change_password = true
   #password_reuse_prevention      = 24 
   max_password_age = 3
@@ -33,4 +33,4 @@ module "cloudtrail" {
 
 module "pki" {
   source = "./modules/pki"
-}
+}

modules/cloudtrail/main.tf

@@ -1,5 +1,19 @@
+resource "aws_kms_key" "my_kms_key" {
+  description = "KMS Key for encryption"
+  key_usage   = "ENCRYPT_DECRYPT"
+  enable_key_rotation = true
+
+  tags = {
+    Name = "snyk-key"
+  }
+}
+
 resource "aws_cloudtrail" "insecure-logging" {
   name           = "cloudtrail-logging"
+  cloud_watch_logs_group_arn = "appLogs"
   s3_bucket_name = "my-cloudtrail-bucket"
-  enable_logging = false
+  enable_logging = true
+  enable_log_file_validation = true
+  is_multi_region_trail = true
+  kms_key_id =  aws_kms_key.my_kms_key.id
 }

modules/pki/main.tf

@@ -1,4 +1,5 @@
 resource "aws_kms_key" "a" {
   description             = "key 1"
   deletion_window_in_days = 10
-}
+  enable_key_rotation = true
+}

modules/storage/main.tf

@@ -2,17 +2,39 @@ resource "aws_s3_bucket" "insecure-bucket" {
   bucket = "insecure-bucket"
 }
 
-# resource "aws_s3_bucket_public_access_block" "insecure-bucket" {
-#   block_public_acls       = true
-#   block_public_policy     = true
-#   ignore_public_acls      = true
-#   restrict_public_buckets = true
-# }
+resource "aws_s3_bucket" "logging-bucket" {
+  bucket = "logging-bucket"
+}
+
+resource "aws_s3_bucket_public_access_block" "insecure-bucket" {
+   block_public_acls       = true
+   block_public_policy     = true
+   ignore_public_acls      = true
+   restrict_public_buckets = true
+   logging {
+    target_bucket = aws_s3_bucket.logging-bucket.id
+    target_prefix = "log/"
+  }
+  versioning {
+    enabled = true
+    mfa_delete = true
+  }
+}
+
+resource "aws_s3_bucket_versioning" "my_bucket_versioning" {
+  bucket = aws_s3_bucket.insecure-bucket.id
+
+    # MFA Delete must be set to Enabled
+   versioning {
+    enabled = true
+    mfa_delete = true
+  }
+}
 
 resource "aws_ebs_volume" "example" {
   availability_zone = "us-east-1a"
   size              = 20
-  encrypted         = false
+  encrypted         = true
   tags = {
     Name = "insecure"
   }

modules/vpc/main.tf

@@ -22,7 +22,7 @@ resource "aws_security_group" "allow_ssh" {
     from_port   = 22
     to_port     = 22
     protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = ["192.16.0.0/24"]
   }
 }