mourya-33

Implement least privilege principle for cloudfront, lambda and db migration stacks

6

…front permissions ### Feature or Bugfix - Bugfix ### Relates [- ](https://github.com/data-dot-all/dataall/issues/877) ### Security Please answer the questions below briefly where applicable, or write `N/A`. Based on [OWASP 10](https://owasp.org/Top10/en/). -...

Add encryption and tag immutability to ECR repository

2

### Feature or Bugfix - Bugfix ### Detail - Currently the ecr repository created do not have encryption and tag immutability enabled which is identified by checkov scans. This fix...

Unrestricted S3 permissions for shares with consumer role

1

### Describe the bug Currently when a share is created for the consumer role, dataall automatically adds s3* permissions on the share. This must be restricted to read permissions only....

Enable encryption for ECR in the ecr stack

1

### Describe the bug Currently, the ECR repository created as part of the ECR stack is not encrypted. This is flagged by checkov as the following failure. CheckID : CKV_AWS_136...

Restrict RAM IAM permissions in pivot role

4

### Describe the bug Pivot Role (auto created and custom) has the following unrestricted permissions on KMS and RAM shares. This role needs to be added as an exception until...

Add dataall IAM AssetsFileRole to checkov baseline

2

### Describe the bug CDK automatically creates an IAM Role - AssetsFileRole for managing the Assets stage in the main cicd code pipeline. However, this role has a default policy...

Restrict Glue and KMS IAM permissions for pivot role

2

### Describe the bug The auto created pivot role has the following unrestricted IAM permissions for Glue that are flagged by checkov scans. The permissions need to be restricted to...

### Describe the bug Glue crawlers do not have any security configuration attached which is flagged by checkov as FAILURE with the error message below. CheckID : CKV_AWS_195 CheckName :...

Implement least privilege permissions for the IAM role SecretsManagerRDSPostgreSQLRotationSingleUserRole

5

### Describe the bug The IAM role SecretsManagerRDSPostgreSQLRotationSingleUserRole has overly permissive permissions that is flagged by checkov scan (scan result below) CheckID : CKV_AWS_111 CheckName : Ensure IAM policies does...

Enable encryption for environment variables in lambdas - cont

1

### Describe the bug The lambda environment variables are not encrypted. This is flagged by checkov as failures Check: CKV_AWS_173: "Check encryption settings for Lambda environmental variable" FAILED for resource:...