Skip to content

DEMO (do not merge): intentionally insecure terraform example#20

Draft
karlllewis wants to merge 1 commit into
mainfrom
demo/bad-examples-v2
Draft

DEMO (do not merge): intentionally insecure terraform example#20
karlllewis wants to merge 1 commit into
mainfrom
demo/bad-examples-v2

Conversation

@karlllewis
Copy link
Copy Markdown
Collaborator

@karlllewis karlllewis commented Aug 14, 2025 •
edited
Loading

🚫 Purposefully Failing PR – Terraform Demo

Goal: Demonstrate CNCISO’s secure-by-default-starter guardrails in action (for terraform).
This PR intentionally includes insecure files that violate our security posture.

❌ What’s in this PR

  • examples/terraform/main.bad.tf → bad s3 policy, wide open security groups, unfiltered egress

🔍 Expected Behavior

  • Pre-commit hooks: Block commits containing HIGH/CRITICAL trivy failures within bad code.
  • CI (security workflow):
    • Run Trivy (vuln + config) and upload SARIF to Code scanning alerts.
    • Generate and publish SBOM (sbom-spdx artifact).
    • Fail the job on HIGH/CRITICAL findings (by design).

This PR is a teaching tool and will remain unmerged to preserve the failing example

github-advanced-security[bot]
github-advanced-security AI found potential problems Aug 14, 2025
View reviewed changes
Comment thread examples/terraform/main.bad.tf
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]

Check failure

Code scanning / Trivy

Security groups should not allow unrestricted ingress to SSH or RDP from any IP address. High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0107
Severity: HIGH
Message: Security group rule allows unrestricted ingress from any IP address.
Link: AVD-AWS-0107
Comment thread examples/terraform/main.bad.tf
from_port = 3389
to_port = 3389
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]

Check failure

Code scanning / Trivy

Security groups should not allow unrestricted ingress to SSH or RDP from any IP address. High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0107
Severity: HIGH
Message: Security group rule allows unrestricted ingress from any IP address.
Link: AVD-AWS-0107
Comment thread examples/terraform/main.bad.tf
from_port = 0
to_port = 65535
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]

Check failure

Code scanning / Trivy

Security groups should not allow unrestricted ingress to SSH or RDP from any IP address. High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0107
Severity: HIGH
Message: Security group rule allows unrestricted ingress from any IP address.
Link: AVD-AWS-0107
Comment thread examples/terraform/main.bad.tf
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]

Check failure

Code scanning / Trivy

A security group rule should not allow unrestricted egress to any IP address. Critical

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability aws-vpc-no-public-egress-sgr
Severity: CRITICAL
Message: Security group rule allows unrestricted egress to any IP address.
Link: aws-vpc-no-public-egress-sgr
Comment thread examples/terraform/main.bad.tf
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]

Check failure

Code scanning / Trivy

A security group rule should not allow unrestricted egress to any IP address. Critical

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability aws-vpc-no-public-egress-sgr
Severity: CRITICAL
Message: Security group rule allows unrestricted egress to any IP address.
Link: aws-vpc-no-public-egress-sgr
Comment thread examples/terraform/main.bad.tf
# No server-side encryption block (BAD)
# No versioning (BAD)
# Public ACL (BAD)
acl = "public-read"

Check failure

Code scanning / Trivy

S3 Buckets not publicly accessible through ACL. High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0092
Severity: HIGH
Message: Bucket has a public ACL: "public-read"
Link: AVD-AWS-0092
Comment thread examples/terraform/main.bad.tf

resource "aws_s3_bucket_public_access_block" "insecure_bucket_pab" {
bucket = aws_s3_bucket.insecure_bucket.id
block_public_acls = false # BAD

Check failure

Code scanning / Trivy

S3 Access block should block public ACL High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0086
Severity: HIGH
Message: Public access block does not block public ACLs
Link: AVD-AWS-0086
Comment thread examples/terraform/main.bad.tf
resource "aws_s3_bucket_public_access_block" "insecure_bucket_pab" {
bucket = aws_s3_bucket.insecure_bucket.id
block_public_acls = false # BAD
block_public_policy = false # BAD

Check failure

Code scanning / Trivy

S3 Access block should block public policy High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0087
Severity: HIGH
Message: Public access block does not block public policies
Link: AVD-AWS-0087
Comment thread examples/terraform/main.bad.tf
bucket = aws_s3_bucket.insecure_bucket.id
block_public_acls = false # BAD
block_public_policy = false # BAD
ignore_public_acls = false # BAD

Check failure

Code scanning / Trivy

S3 Access Block should Ignore Public ACL High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0091
Severity: HIGH
Message: Public access block does not ignore public ACLs
Link: AVD-AWS-0091
Comment thread examples/terraform/main.bad.tf
block_public_acls = false # BAD
block_public_policy = false # BAD
ignore_public_acls = false # BAD
restrict_public_buckets = false # BAD

Check failure

Code scanning / Trivy

S3 Access block should restrict public bucket to limit access High

Artifact: examples/terraform/main.bad.tf
Type: terraform
Vulnerability AVD-AWS-0093
Severity: HIGH
Message: Public access block does not restrict public buckets
Link: AVD-AWS-0093
@karlllewis karlllewis marked this pull request as draft August 14, 2025 06:06
@karlllewis karlllewis changed the title examples(tf): intentionally insecure demo (open SG and public S3) DEMO: intentionally insecure terraform example Aug 14, 2025
@karlllewis karlllewis changed the title DEMO: intentionally insecure terraform example DEMO (do not merge): intentionally insecure terraform example Aug 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@karlllewis @github-advanced-security