Infrastructure policies for Terraform

This Guardrail ensures that all EC2 instances are configured to only allow IMDSv2 for the EC2 Instance Metadata Service. Enforcing IMDSv2 enhances security by requiring session-based authentication, which mitigates the risk of unauthorized metadata retrieval.

This Guardrail ensures that default security groups restrict all traffic. This ensures security groups are always assigned explicitly to resources and can help prevent unintended exposure of resources to the internet.

This Guardrail ensures that no AWS Security Groups allow ingress from ::/0 to remote server administration ports. Blocking unrestricted access to ports such as 22 (SSH) and 3389 (RDP) can prevent unauthorized external access to critical infrastructure.

This Guardrail ensures that no AWS Security Groups allow ingress from 0.0.0.0/0 to remote server administration ports. Blocking unrestricted access to ports such as 22 (SSH) and 3389 (RDP) can prevent unauthorized external access to critical infrastructure.

This Guardrail ensures that no AWS Network ACLs allow traffic from remote server administration ports with a CIDR block of 0.0.0.0/0 or ::/0. AWS Network ACLs are stateless and matching outbound traffic can not be allowed independently of inbound traffic.

This Guardrail ensures that no AWS Security Groups allow ingress from 0.0.0.0/0 to CIFS port 445. Blocking unrestricted access to CIFS ports prevents unauthorized external access to critical infrastructure.

This Guardrail ensures that AWS CloudTrail is configured to log object-level read events for all S3 buckets. Enabling object-level logging for read events enhances security by providing visibility into changes made to objects within S3.

This Guardrail ensures that AWS CloudTrail is configured to log object-level write events for all S3 buckets. Enabling object-level logging for write events enhances security by providing visibility into changes made to objects within S3.

This Guardrail ensures that automatic key rotation is enabled on Symmetric KMS Customer Managed Keys (CMKs).

This Guardrail ensures that AWS CloudTrail logs are encrypted at rest using AWS Key Management Service (KMS) Customer Managed Keys (CMKs).

This Guardrail ensures that AWS CloudTrail log file validation is enabled. Enabling log file validation provides additional integrity checks for CloudTrail logs and allows for detection of unauthorized changes to log files.

This Guardrail ensures that Amazon Elastic File System (EFS) file systems have encryption-at-rest enabled using AWS Key Management Service (KMS).

This Guardrail ensures that Amazon RDS instances and RDS clusters are deployed with Multi-AZ enabled. Multi-AZ deployments improve availability and fault tolerance by maintaining a standby replica in multiple Availability Zones.

This Guardrail ensures that Amazon RDS instances are not publicly accessible, preventing unauthorized access from the internet.

This Guardrail ensures that Amazon RDS instances have the Auto Minor Version Upgrade feature enabled. Enabling automatic minor version upgrades ensures that RDS instances receive security patches and improvements without manual intervention.

This Guardrail ensures that Amazon RDS instances have encryption-at-rest enabled.

This Guardrail ensures that MFA Delete is enabled on versioned S3 buckets. MFA Delete provides an extra layer of protection by requiring multi-factor authentication to delete objects or change versioning settings, reducing the risk of accidental or malicious deletions.

This Guardrail restricts attachment of the AWS managed policy arn:aws:iam::aws:policy/AWSCloudShellFullAccess to IAM roles and users.

This Guardrail ensures that IAM Access Keys are not created in terraform. Requiring additional steps to be taken by the user for programmatic access provides a stronger indication of intent that access keys are necessary and in use.

This Guardrail ensures that IAM users do not receive permissions directly via inline policies or directly attached managed policies. Instead, permissions should only be granted through IAM groups.

This Guardrail ensures that the IAM password policy prevents password reuse by remembering the last 24 passwords.

This Guardrail ensures that the IAM password policy requires a minimum length of 14 or greater. This implements the AWS CIS Foundations Control 1.8 when the aws_iam_account_password_policy resource exists, however, it can not enforce the presence of this resource in a given AWS Account.

Ensures CloudTrail records global service events for complete monitoring.

Ensures S3 buckets enforce public access blocks to prevent unintended exposure.

Ensures that CloudTrail log file validation is enabled to verify log integrity.

Ensures that CloudTrail logs are encrypted using a KMS key for data protection.

Facilitates near real-time monitoring and alerting on CloudTrail events.

Ensures that all VPC traffic is logged for auditing and threat detection.

Ensures CloudTrail is configured to record events in all regions for comprehensive logging.

Ensures that VPC subnetworks log flow data for auditing and compliance.

Ensures that network security group flow logs are enabled for auditing and compliance.

Prevents use of default VPCs to enforce custom network segmentation.

Captures audit trails by ensuring diagnostic logging is enabled on Azure resources.

Helps ensure data in transit is encrypted by restricting HTTP access.

Helps ensure secure credentials for Azure users via Azure AD password complexity.

Enforces annual rotation for AWS KMS Customer Managed Keys.

Ensures that AWS RDS instances are encrypted to safeguard stored personal data.

Blocks public traffic by disallowing 0.0.0.0/0 in Azure Network Security Group rules.

Prevents anonymous access to GCS data.

Blocks direct internet exposure for Azure SQL databases.

Ensures GCS data is encrypted at rest using KMS.

Ensures data at rest is encrypted by default on Azure Storage.

Prevents anonymous access to blob containers or file shares.

Ensures data at rest is protected on Azure VM disks.

Blocks direct internet exposure of Cloud SQL instances.

Provides visibility into configuration changes by recording all supported resources.

Prevents public exposure by disallowing 0.0.0.0/0 in GCP firewall ingress.

Helps ensure database instances are not directly exposed to the internet.

Ensures data at rest is protected on GCE persistent disks.

Prevents accidental exposure of S3 data to the internet.

Ensures data at rest is protected on EBS volumes.

Prevents unintended public exposure by disallowing 0.0.0.0/0 in security group ingress.

Ensures IAM users have sufficiently complex passwords.

Ensures S3 data is encrypted at rest.

Facilitates real-time monitoring and alerting on CloudTrail events.

Sending CloudTrail logs to CloudWatch is important because it makes it easier to monitor AWS API activity in real time and set up automated alerts. By streaming CloudTrail events into CloudWatch, you can quickly detect suspicious actions—like unexpected IAM user logins or resource deletions—and trigger alarms or automated responses.

Protects EBS volumes by requiring an encryption with a KMS key.