defsec
defsec copied to clipboard
Feat: AWS CIS 1.4
These checks amount to the automatable components for satisfying AWS CIS 1.4
For each issue below, the following steps are required;
- Abstraction Object
- If there is no object (eg;
pkg/providers/aws/s3/s3.go
) one will need to be created - Add a property to represent the AWS attribute under test using the
types
package (eg;types.StringValue
)
- If there is no object (eg;
- Adapter
- If there is no adapter (eg;
internal/adapters/cloud/aws/s3/s3.go
) one will need to be created - Using API calls get the required values
- Where the service supports localstack, add tests like
internal/adapters/cloud/aws/s3_test.go
- If there is no adapter (eg;
- Rule
- Run
make id
to get the next available ID - Add a Rule to `internal/rules/aws/<serviceName>
- Run
- Docs
- add docs to
avd_docs
for the new rule; (eg;avd_docs/aws/s3/AVD-AWS-0086
)
- add docs to
Where appropriate, update the Terraform and Cloudformation Adapter to support the new attribute and add rule information - (eg; internal/rules/aws/s3/block_public_acls.[cf|tf].go
)
- [x] https://github.com/aquasecurity/defsec/issues/859
- [ ] https://github.com/aquasecurity/defsec/issues/860
- [x] https://github.com/aquasecurity/defsec/issues/861
- [x] https://github.com/aquasecurity/defsec/issues/862
- [x] https://github.com/aquasecurity/defsec/issues/863
- [x] https://github.com/aquasecurity/defsec/issues/864
- [ ] https://github.com/aquasecurity/defsec/issues/865
- [ ] https://github.com/aquasecurity/defsec/issues/866
- [ ] https://github.com/aquasecurity/defsec/issues/867
- [x] https://github.com/aquasecurity/defsec/issues/868
- [ ] https://github.com/aquasecurity/defsec/issues/869
- [ ] https://github.com/aquasecurity/defsec/issues/870