xwtro0tk1t-cloud/harness/security-review-skill-for-terraform

git diff --name-only <base>...<target> -- '*.tf' '*.tfvars' 'terragrunt.hcl'

variable "db_password" → local.config → resource.aws_db_instance.password
                       → tfvars 文件中是否明文？
                       → State 文件中是否存储？

# 危险：明文密码
resource "aws_db_instance" "main" {
  password = "MyS3cretP@ss!"  # 硬编码
}
 
resource "aws_iam_access_key" "user" {
  user = aws_iam_user.example.name
  # access_key/secret_key 会存入 State
}
 
# 安全：引用 Secrets Manager
resource "aws_db_instance" "main" {
  password = data.aws_secretsmanager_secret_version.db.secret_string
}
 
# 安全：标记 sensitive
variable "db_password" {
  type      = string
  sensitive = true
}

# 危险：本地 State（含所有资源属性，包括密码）
terraform {
  backend "local" {}  # State 文件存在本地磁盘
}
 
# 安全：远程 State + 加密
terraform {
  backend "s3" {
    bucket         = "my-tf-state"
    key            = "prod/terraform.tfstate"
    encrypt        = true
    dynamodb_table = "tf-locks"
  }
}

# 危险：全开入站
resource "aws_security_group_rule" "bad" {
  type        = "ingress"
  from_port   = 0
  to_port     = 65535
  protocol    = "-1"
  cidr_blocks = ["0.0.0.0/0"]
}
 
# 危险：SSH/RDP 对公网开放
resource "aws_security_group_rule" "ssh_open" {
  type        = "ingress"
  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]  # SSH 对全互联网开放
}
 
# 安全：限制到 VPN/堡垒机 IP
resource "aws_security_group_rule" "ssh" {
  type        = "ingress"
  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["10.0.0.0/8"]  # 仅内网
}

# 危险：S3 流量走公网（可被拦截）
# 无 aws_vpc_endpoint for s3
 
# 安全：VPC Endpoint 限制 S3 访问
resource "aws_vpc_endpoint" "s3" {
  vpc_id       = aws_vpc.main.id
  service_name = "com.amazonaws.ap-southeast-1.s3"
  route_table_ids = [aws_route_table.private.id]
  policy = jsonencode({
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "s3:*"
      Resource  = ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"]
    }]
  })
}

# 危险：管理员权限
resource "aws_iam_policy" "admin" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = "*"           # 全部操作
      Resource = "*"           # 全部资源
    }]
  })
}
 
# 危险：通配符 Action
resource "aws_iam_policy" "too_wide" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:*"       # S3 全部操作
      Resource = "*"
    }]
  })
}
 
# 安全：最小权限
resource "aws_iam_policy" "minimal" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject", "s3:ListBucket"]
      Resource = [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }]
  })
}

# 危险：任何 AWS 账户可 AssumeRole
resource "aws_iam_role" "bad" {
  assume_role_policy = jsonencode({
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "*" }  # 任何人
      Action    = "sts:AssumeRole"
    }]
  })
}

# 危险：S3 无服务端加密
resource "aws_s3_bucket" "data" {
  bucket = "sensitive-data"
  # 缺少 server_side_encryption_configuration
}
 
# 危险：RDS 未加密
resource "aws_db_instance" "main" {
  storage_encrypted = false  # 或缺失此属性
}
 
# 危险：EBS 未加密
resource "aws_ebs_volume" "data" {
  encrypted = false
}
 
# 安全
resource "aws_s3_bucket_server_side_encryption_configuration" "enc" {
  bucket = aws_s3_bucket.data.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

# 危险：S3 公开读
resource "aws_s3_bucket_acl" "public" {
  bucket = aws_s3_bucket.data.id
  acl    = "public-read"
}
 
# 危险：S3 公开访问未阻止
resource "aws_s3_bucket_public_access_block" "bad" {
  bucket                  = aws_s3_bucket.data.id
  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}
 
# 安全
resource "aws_s3_bucket_public_access_block" "secure" {
  bucket                  = aws_s3_bucket.data.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# 危险
resource "aws_db_instance" "public_db" {
  publicly_accessible = true
}
 
# 危险：ElastiCache 无加密
resource "aws_elasticache_replication_group" "bad" {
  at_rest_encryption_enabled = false
  transit_encryption_enabled = false
}
 
# 危险：EKS API Server 公开
resource "aws_eks_cluster" "public" {
  vpc_config {
    endpoint_public_access  = true
    public_access_cidrs     = ["0.0.0.0/0"]
  }
}

# 危险：无版本约束
terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      # 缺少 version 约束
    }
  }
}
 
# 安全
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# 危险：输出敏感值
output "db_password" {
  value = aws_db_instance.main.password
  # 缺少 sensitive = true
}

# 危险：S3 无版本化（数据可被覆盖/删除）
resource "aws_s3_bucket_versioning" "none" {
  bucket = aws_s3_bucket.data.id
  versioning_configuration {
    status = "Disabled"
  }
}
 
# 危险：RDS 无备份
resource "aws_db_instance" "no_backup" {
  backup_retention_period = 0
}

# 危险：生产数据库可被 terraform destroy 直接删除
resource "aws_db_instance" "prod" {
  deletion_protection = false  # 或缺失
}