Lab 09: 보안 스캔 통합

terraform {
  required_version = ">= 1.0.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-2"
}

# 버킷 이름 중복 방지를 위한 무작위 접미사
resource "random_string" "suffix" {
  length  = 8
  special = false
  upper   = false
}

# ❌ 취약점 1: 퍼블릭 액세스 차단 없음
resource "aws_s3_bucket" "bad" {
  bucket = "lab09-insecure-bucket-${random_string.suffix.result}"
}

# ❌ 취약점 2: 암호화 없음 (버킷 수준 암호화 미설정)

# ❌ 취약점 3: 버전 관리 비활성화
resource "aws_s3_bucket_versioning" "bad" {
  bucket = aws_s3_bucket.bad.id
  versioning_configuration {
    status = "Disabled"
  }
}

# ❌ 취약점 4: 보안 그룹 — SSH를 전체 인터넷에 개방
resource "aws_security_group" "bad" {
  name = "lab09-insecure-sg-${random_string.suffix.result}"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]   # 전체 인터넷 허용
  }

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]   # RDP도 전체 허용
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# macOS
brew install tfsec

# Linux
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

# 스캔 실행
cd lab09-security-scan/insecure
tfsec .

# pip 설치
pip3 install checkov

# 스캔 실행
checkov -d insecure/

# JSON 형식 출력 (CI/CD 파싱용)
checkov -d insecure/ -o json > checkov-report.json

# 특정 체크만 실행
checkov -d insecure/ --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20

# 버킷 이름 중복 방지를 위한 무작위 접미사
resource "random_string" "suffix" {
  length  = 8
  special = false
  upper   = false
}

# ✅ S3 버킷 기본 생성
resource "aws_s3_bucket" "good" {
  bucket = "lab09-secure-bucket-${random_string.suffix.result}"
}

# ✅ 취약점 1 수정: 퍼블릭 액세스 전면 차단
resource "aws_s3_bucket_public_access_block" "good" {
  bucket = aws_s3_bucket.good.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# ✅ 취약점 2 수정: 서버 측 암호화 활성화
resource "aws_s3_bucket_server_side_encryption_configuration" "good" {
  bucket = aws_s3_bucket.good.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# ✅ 취약점 3 수정: 버전 관리 활성화
resource "aws_s3_bucket_versioning" "good" {
  bucket = aws_s3_bucket.good.id
  versioning_configuration {
    status = "Enabled"
  }
}

# ✅ 액세스 로깅 활성화 (tfsec HIGH 탐지 항목)
resource "aws_s3_bucket_logging" "good" {
  bucket        = aws_s3_bucket.good.id
  target_bucket = aws_s3_bucket.good.id
  target_prefix = "access-logs/"
}

# ✅ 취약점 4 수정: 보안 그룹 — 최소 권한 원칙 적용
resource "aws_security_group" "good" {
  name        = "lab09-secure-sg-${random_string.suffix.result}"
  description = "Secure security group"

  ingress {
    description = "SSH from corporate network only"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]   # 내부 네트워크만 허용
  }

  # RDP 규칙 제거 — 필요하면 VPN 또는 Session Manager 사용

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

cd lab09-security-scan/secure
tfsec .
# 0 potential problems detected. ✅

checkov -d .
# Passed checks: 10, Failed checks: 0 ✅

name: Terraform Security Scan

on:
  pull_request:
    paths:
      - "**.tf"
  push:
    branches: [main]
    paths:
      - "**.tf"

permissions:
  contents: read
  pull-requests: write
  security-events: write # SARIF 업로드용

jobs:
  tfsec:
    name: tfsec
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: tfsec 실행
        uses: aquasecurity/tfsec-action@v1.0.0
        with:
          soft_fail: false # 취약점 발견 시 워크플로 실패
          format: lovely # 가독성 높은 출력 형식

      - name: tfsec SARIF 업로드 (GitHub Security 탭 연동)
        uses: aquasecurity/tfsec-sarif-action@v0.1.0
        if: always()
        with:
          sarif_file: tfsec.sarif

      - name: SARIF 파일을 GitHub Security에 업로드
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: tfsec.sarif

  checkov:
    name: checkov
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: checkov 실행
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: .
          framework: terraform
          output_format: cli,sarif
          output_file_path: console,checkov-results.sarif
          soft_fail: false

      - name: SARIF 파일을 GitHub Security에 업로드
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: checkov-results.sarif