Merge branch 'main' into ghasctl-1713378264

.github/workflows/pull-request.yaml

@@ -0,0 +1,96 @@
+name: On Pull Request
+
+on:
+    pull_request:
+        types: [opened, synchronize]
+
+jobs:
+    get-changes:
+        name: Get Changed Files
+        runs-on: ubuntu-latest
+        outputs:
+          any_changed: ${{ steps.changed-files.outputs.any_changed }}
+        steps:
+        - name: Checkout code
+          uses: actions/checkout@v4
+          with:
+            fetch-depth: 1
+
+        - name: Get changed files
+          id: changed-files
+          uses: tj-actions/changed-files@v44
+          with:
+            files: "*.tf"
+
+        - name: List all changed files
+          run: echo '${{ steps.changed-files.outputs.all_changed_files }}'
+
+    tflint:
+        name: Run TFLint
+        runs-on: ubuntu-latest
+        needs:
+        - get-changes
+        steps:
+        - name: Checkout code
+          uses: actions/checkout@v4
+          with:
+            fetch-depth: 1
+
+        - uses: actions/cache@v4
+          name: Cache plugin dir
+          with:
+            path: ~/.tflint.d/plugins
+            key: tflint-${{ hashFiles('.tflint.hcl') }}
+
+        - uses: terraform-linters/setup-tflint@v4
+          name: Setup TFLint
+          with:
+            tflint_version: v0.50.3
+
+        - name: Show version
+          run: tflint --version
+
+        - name: Init TFLint
+          run: tflint --init
+
+        - name: Run TFLint
+          run: tflint --disable-rule=terraform_required_version
+
+    terraform-fmt:
+        name: Terraform Format
+        runs-on: ubuntu-latest
+        needs:
+        - get-changes
+        permissions:
+            contents: write
+            pull-requests: read
+        steps:
+        - name: Checkout code
+          uses: actions/checkout@v4
+          with:
+            ref: ${{ github.event.pull_request.head.sha }}
+
+        - uses: hashicorp/setup-terraform@v3
+          with:
+            terraform_version: 1.6.0
+
+        - name: Terraform Format
+          run: terraform fmt --recursive .
+
+        - uses: dorny/paths-filter@v3
+          id: filter
+          with:
+            token: ${{ secrets.GITHUB_TOKEN }}
+            base: HEAD
+            filters: |
+                terraform:
+                - '*.tf'
+
+        - name: Commit changes
+          if: steps.filter.outputs.terraform == 'true'
+          run: |
+            git config --global user.email "github-actions[bot]@users.noreply.github.com"
+            git config --global user.name "github-actions[bot]"
+            git add *.tf
+            git commit -m "Auto-format Terraform files"
+            git push origin HEAD:${{ github.event.pull_request.head.ref }}

.github/workflows/update-rules.yaml

@@ -0,0 +1,79 @@
+name: Update Config Rules
+
+on:
+  schedule:
+    - cron: '0 0 1,15 * *'
+  workflow_dispatch:
+
+jobs:
+  update-rules:
+    name: Update Rules
+    runs-on: ubuntu-latest
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Update rules
+        id: update-rules
+        run: |
+          cd scripts
+          pip install -r requirements.txt
+          python index.py update-config-rules
+          python index.py update-rule-packs
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v44
+        with:
+          files: |
+            "*.tf"
+            "files/*"
+
+      - name: List all changed files
+        run: echo '${{ steps.changed-files.outputs.all_changed_files }}'
+
+      - uses: actions/cache@v4
+        name: Cache plugin dir
+        with:
+          path: ~/.tflint.d/plugins
+          key: tflint-${{ hashFiles('.tflint.hcl') }}
+
+      - uses: terraform-linters/setup-tflint@v4
+        name: Setup TFLint
+        with:
+          tflint_version: v0.50.3
+
+      - name: Show version
+        run: tflint --version
+
+      - name: Init TFLint
+        run: tflint --init
+
+      - name: Run TFLint
+        run: tflint --disable-rule=terraform_required_version
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.6.0
+
+      - name: Terraform Format
+        run: terraform fmt --recursive .
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          base: main
+          branch: auto-update-aws-config-rules
+          add-paths: |
+            managed_rules_*.tf
+            files/*
+          commit-message: Automatic updates to AWS managed Config Rules
+          delete-branch: true
+          title: '[Auto] Update AWS Config Rules'
+          body: |
+            Update the list of AWS managed Config Rules using the [latest documentation](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html).
+          assignees: bensonce
+          reviewers: bensonce,duraikkannuv2

etc/severity_overrides.yaml

@@ -0,0 +1,43 @@
+overrides:
+  desired-instance-tenancy:
+    severity: Low
+  desired-instance-type:
+    severity: Low
+  cloudformation-stack-drift-detection-check:
+    severity: Low
+  cloudtrail-s3-bucket-public-access-prohibited:
+    severity: High
+  codepipeline-deployment-count-check:
+    severity: Low
+  codepipeline-region-fanout-check:
+    severity: Low
+  ebs-optimized-instance:
+    severity: Low
+  ec2-instance-detailed-monitoring-enabled:
+    severity: Low
+  ec2-instance-profile-attached:
+    severity: Low
+  ec2-no-amazon-key-pair:
+    severity: Low
+  ec2-token-hop-limit-check:
+    severity: Low
+  ec2-volume-inuse-check:
+    severity: Low
+  guardduty-eks-protection-runtime-enabled:
+    severity: Low
+  internet-gateway-authorized-vpc-only:
+    severity: High
+  lambda-dlq-check:
+    severity: Low
+  s3-bucket-replication-enabled:
+    severity: Low
+  s3-resources-protected-by-backup-plan:
+    severity: High
+  storagegateway-last-backup-recovery-point-created:
+    severity: High
+  virtualmachine-last-backup-recovery-point-created:
+    severity: High
+  virtualmachine-resources-protected-by-backup-plan:
+    severity: High
+  vpc-peering-dns-resolution-check:
+    severity: High

files/pack-rules-list.txt

@@ -102,4 +102,4 @@ Security-Best-Practices-for-Network-Firewall
 Security-Best-Practices-for-RDS
 Security-Best-Practices-for-Redshift
 Security-Best-Practices-for-SageMaker
-Security-Best-Practices-for-Secrets-Manager
+Security-Best-Practices-for-Secrets-Manager