Skip to content

Commit d02fef3

Browse files
cx-andre-pereiragithub-actions[bot]
cx-andre-pereira
authored and
github-actions[bot]
committed
docs(queries): update queries catalog
1 parent 1eb7417 commit d02fef3

File tree

68 files changed

+20680
-3179
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+20680
-3179
lines changed

‎docs/queries/all-queries.md‎

Lines changed: 32 additions & 5 deletions
Large diffs are not rendered by default.

‎docs/queries/ansible-queries.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ Below are listed queries related to Ansible AWS:
9292
|API Gateway without WAF<br/><sup><sub>f5f38943-664b-4acc-ab11-f292fa10ed0b</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../ansible-queries/aws/f5f38943-664b-4acc-ab11-f292fa10ed0b" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/f5f38943-664b-4acc-ab11-f292fa10ed0b')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/wafv2_resources_module.html#parameter-arn">Documentation</a><br/>|
9393
|CloudFront Without WAF<br/><sup><sub>22c80725-e390-4055-8d14-a872230f6607</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../ansible-queries/aws/22c80725-e390-4055-8d14-a872230f6607" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/22c80725-e390-4055-8d14-a872230f6607')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/cloudfront_distribution_module.html">Documentation</a><br/>|
9494
|EC2 Instance Has Public IP<br/><sup><sub>a8b0c58b-cd25-4b53-9ad0-55bca0be0bc1</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../ansible-queries/aws/a8b0c58b-cd25-4b53-9ad0-55bca0be0bc1" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/a8b0c58b-cd25-4b53-9ad0-55bca0be0bc1')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/ec2_module.html#parameter-assign_public_ip">Documentation</a><br/>|
95+
|ECS Services assigned with public IP address<br/><sup><sub>560f256b-0b45-4496-bcb5-733681e7d38d</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../ansible-queries/aws/560f256b-0b45-4496-bcb5-733681e7d38d" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/560f256b-0b45-4496-bcb5-733681e7d38d')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/ecs_service_module.html">Documentation</a><br/>|
9596
|Elasticsearch with HTTPS disabled<br/><sup><sub>d6c2d06f-43c1-488a-9ba1-8d75b40fc62d</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../ansible-queries/aws/d6c2d06f-43c1-488a-9ba1-8d75b40fc62d" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/d6c2d06f-43c1-488a-9ba1-8d75b40fc62d')">Query details</a><br><a href="https://docs.ansible.com/ansible/devel/collections/community/aws/opensearch_module.html">Documentation</a><br/>|
9697
|HTTP Port Open To Internet<br/><sup><sub>a14ad534-acbe-4a8e-9404-2f7e1045646e</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../ansible-queries/aws/a14ad534-acbe-4a8e-9404-2f7e1045646e" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/a14ad534-acbe-4a8e-9404-2f7e1045646e')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/ec2_group_module.html#ansible-collections-amazon-aws-ec2-group-module">Documentation</a><br/>|
9798
|Security Group With Unrestricted Access To SSH<br/><sup><sub>57ced4b9-6ba4-487b-8843-b65562b90c77</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../ansible-queries/aws/57ced4b9-6ba4-487b-8843-b65562b90c77" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/57ced4b9-6ba4-487b-8843-b65562b90c77')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/ec2_group_module.html">Documentation</a><br/>|
@@ -114,6 +115,7 @@ Below are listed queries related to Ansible AWS:
114115
|CloudTrail Log Files Not Encrypted With KMS<br/><sup><sub>f5587077-3f57-4370-9b4e-4eb5b1bac85b</sub></sup>|<span style="color:#edd57e">Low</span>|Encryption|<a href="../ansible-queries/aws/f5587077-3f57-4370-9b4e-4eb5b1bac85b" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/f5587077-3f57-4370-9b4e-4eb5b1bac85b')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/cloudtrail_module.html">Documentation</a><br/>|
115116
|EFS Without KMS<br/><sup><sub>bd77554e-f138-40c5-91b2-2a09f878608e</sub></sup>|<span style="color:#edd57e">Low</span>|Encryption|<a href="../ansible-queries/aws/bd77554e-f138-40c5-91b2-2a09f878608e" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/bd77554e-f138-40c5-91b2-2a09f878608e')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/efs_module.html#parameter-kms_key_id">Documentation</a><br/>|
116117
|AWS Password Policy With Unchangeable Passwords<br/><sup><sub>e28ceb92-d588-4166-aac5-766c8f5b7472</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../ansible-queries/aws/e28ceb92-d588-4166-aac5-766c8f5b7472" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/e28ceb92-d588-4166-aac5-766c8f5b7472')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/iam_password_policy_module.html">Documentation</a><br/>|
118+
|Instance Uses Metadata Service IMDSv1<br/><sup><sub>b9ef8c0e-1392-4df4-aa84-2e0f95681c75</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../ansible-queries/aws/b9ef8c0e-1392-4df4-aa84-2e0f95681c75" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/b9ef8c0e-1392-4df4-aa84-2e0f95681c75')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/ec2_instance_module.html">Documentation</a><br/>|
117119
|Instance With No VPC<br/><sup><sub>61d1a2d0-4db8-405a-913d-5d2ce49dff6f</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../ansible-queries/aws/61d1a2d0-4db8-405a-913d-5d2ce49dff6f" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/61d1a2d0-4db8-405a-913d-5d2ce49dff6f')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/ec2_module.html">Documentation</a><br/>|
118120
|Lambda Function Without Tags<br/><sup><sub>265d9725-2fb8-42a2-bc57-3279c5db82d5</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../ansible-queries/aws/265d9725-2fb8-42a2-bc57-3279c5db82d5" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/265d9725-2fb8-42a2-bc57-3279c5db82d5')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/lambda_module.html">Documentation</a><br/>|
119121
|EC2 Instance Using Default VPC<br/><sup><sub>8833f180-96f1-46f4-9147-849aafa56029</sub></sup>|<span style="color:#edd57e">Low</span>|Networking and Firewall|<a href="../ansible-queries/aws/8833f180-96f1-46f4-9147-849aafa56029" onclick="newWindowOpenerSafe(event, '../ansible-queries/aws/8833f180-96f1-46f4-9147-849aafa56029')">Query details</a><br><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/ec2_module.html#parameter-vpc_subnet_id">Documentation</a><br/>|

‎docs/queries/ansible-queries/aws/560f256b-0b45-4496-bcb5-733681e7d38d.md‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
---
2+
title: ECS Services assigned with public IP address
3+
hide:
4+
toc: true
5+
navigation: true
6+
---
7+
8+
<style>
9+
.highlight .hll {
10+
background-color: #ff171742;
11+
}
12+
.md-content {
13+
max-width: 1100px;
14+
margin: 0 auto;
15+
}
16+
</style>
17+
18+
- **Query id:** 560f256b-0b45-4496-bcb5-733681e7d38d
19+
- **Query name:** ECS Services assigned with public IP address
20+
- **Platform:** Ansible
21+
- **Severity:** <span style="color:#ff7213">Medium</span>
22+
- **Category:** Networking and Firewall
23+
- **CWE:** <a href="https://cwe.mitre.org/data/definitions/201.html" onclick="newWindowOpenerSafe(event, 'https://cwe.mitre.org/data/definitions/201.html')">201</a>
24+
- **URL:** [Github](https://github.com/Checkmarx/kics/tree/master/assets/queries/ansible/aws/ecs_services_assigned_with_public_ip_address)
25+
26+
### Description
27+
Amazon ECS Services should not be assigned public IP addresses. Public IP assignment exposes services directly to the internet, increasing the attack surface and potential unauthorized access.<br>
28+
[Documentation](https://docs.ansible.com/ansible/latest/collections/community/aws/ecs_service_module.html)
29+
30+
### Code samples
31+
#### Code samples with security vulnerabilities
32+
```yaml title="Positive test num. 1 - yaml file" hl_lines="19"
33+
- name: positive1
34+
hosts: localhost
35+
gather_facts: false
36+
tasks:
37+
- name: Create ECS service with network configuration
38+
community.aws.ecs_service:
39+
state: present
40+
name: example-public-ip-service
41+
cluster: my-ecs-cluster
42+
task_definition: my-task-def:1
43+
desired_count: 2
44+
launch_type: FARGATE
45+
network_configuration:
46+
subnets:
47+
- subnet-aaaa1111
48+
- subnet-bbbb2222
49+
security_groups:
50+
- sg-cccc3333
51+
assign_public_ip: true
52+
53+
```
54+
```yaml title="Positive test num. 2 - yaml file" hl_lines="19"
55+
- name: positive2-legacy
56+
hosts: localhost
57+
gather_facts: false
58+
tasks:
59+
- name: Create ECS service with network configuration
60+
ecs_service:
61+
state: present
62+
name: example-public-ip-service
63+
cluster: my-ecs-cluster
64+
task_definition: my-task-def:1
65+
desired_count: 2
66+
launch_type: FARGATE
67+
network_configuration:
68+
subnets:
69+
- subnet-aaaa1111
70+
- subnet-bbbb2222
71+
security_groups:
72+
- sg-cccc3333
73+
assign_public_ip: true
74+
75+
```
76+
77+
78+
#### Code samples without security vulnerabilities
79+
```yaml title="Negative test num. 1 - yaml file"
80+
- name: negative1
81+
hosts: localhost
82+
gather_facts: false
83+
tasks:
84+
- name: Create ECS service with network configuration
85+
community.aws.ecs_service:
86+
state: present
87+
name: example-public-ip-service
88+
cluster: my-ecs-cluster
89+
task_definition: my-task-def:1
90+
desired_count: 2
91+
launch_type: FARGATE
92+
network_configuration:
93+
subnets:
94+
- subnet-aaaa1111
95+
- subnet-bbbb2222
96+
security_groups:
97+
- sg-cccc3333
98+
assign_public_ip: false
99+
100+
```
101+
```yaml title="Negative test num. 2 - yaml file"
102+
- name: negative2
103+
hosts: localhost
104+
gather_facts: false
105+
tasks:
106+
- name: Create ECS service on FARGATE without assign_public_ip
107+
community.aws.ecs_service:
108+
state: present
109+
name: service-no-public-ip
110+
cluster: my-cluster
111+
task_definition: my-task-def:1
112+
desired_count: 1
113+
launch_type: FARGATE
114+
network_configuration:
115+
subnets:
116+
- subnet-aaaa1111
117+
security_groups:
118+
- sg-bbbb2222
119+
120+
```
121+
```yaml title="Negative test num. 3 - yaml file"
122+
- name: negative3
123+
hosts: localhost
124+
gather_facts: false
125+
tasks:
126+
- name: Create ECS service on EC2 without network_configuration
127+
community.aws.ecs_service:
128+
state: present
129+
name: service-on-ec2
130+
cluster: my-cluster
131+
task_definition: my-task-def:2
132+
desired_count: 2
133+
launch_type: EC2
134+
135+
```
136+
<details><summary>Negative test num. 4 - yaml file</summary>
137+
138+
```yaml
139+
- name: negative1
140+
hosts: localhost
141+
gather_facts: false
142+
tasks:
143+
- name: Create ECS service with network configuration
144+
ecs_service:
145+
state: present
146+
name: example-public-ip-service
147+
cluster: my-ecs-cluster
148+
task_definition: my-task-def:1
149+
desired_count: 2
150+
launch_type: FARGATE
151+
network_configuration:
152+
subnets:
153+
- subnet-aaaa1111
154+
- subnet-bbbb2222
155+
security_groups:
156+
- sg-cccc3333
157+
assign_public_ip: false
158+
159+
```
160+
</details>
161+
<details><summary>Negative test num. 5 - yaml file</summary>
162+
163+
```yaml
164+
- name: negative2
165+
hosts: localhost
166+
gather_facts: false
167+
tasks:
168+
- name: Create ECS service on FARGATE without assign_public_ip
169+
ecs_service:
170+
state: present
171+
name: service-no-public-ip
172+
cluster: my-cluster
173+
task_definition: my-task-def:1
174+
desired_count: 1
175+
launch_type: FARGATE
176+
network_configuration:
177+
subnets:
178+
- subnet-aaaa1111
179+
security_groups:
180+
- sg-bbbb2222
181+
182+
```
183+
</details>
184+
<details><summary>Negative test num. 6 - yaml file</summary>
185+
186+
```yaml
187+
- name: negative3
188+
hosts: localhost
189+
gather_facts: false
190+
tasks:
191+
- name: Create ECS service on EC2 without network_configuration
192+
ecs_service:
193+
state: present
194+
name: service-on-ec2
195+
cluster: my-cluster
196+
task_definition: my-task-def:2
197+
desired_count: 2
198+
launch_type: EC2
199+
200+
```
201+
</details>

0 commit comments

Comments
 (0)