Some insecure code #4
Conversation
![jit-ci[bot]](https://avatars.githubusercontent.com/in/142441?s=60&v=4){kind=small}
| @@ -0,0 +1,23 @@ | |||
| resource "aws_s3_bucket" "this" { | |||
There was a problem hiding this comment.
Security control: Iac Misconfig Detection
Type: S3 Bucket Sse Disabled
Description: If algorithm is AES256 then the master key is null, empty or undefined, otherwise the master key is required
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_findingIgnore this specific single instance of finding#jit_ignore_type_this_repoIgnore any finding of this type in this repo#jit_undo_ignoreUndo ignore command
| bucket = var.bucket_name | ||
| acl = "public" | ||
|
|
||
| versioning { |
There was a problem hiding this comment.
Security control: Iac Misconfig Detection
Type: S3 Bucket Without Enabled Mfa Delete
Description: S3 bucket without MFA Delete Enabled. MFA delete cannot be enabled through Terraform, it can be done by adding a MFA device (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html) and enabling versioning and MFA delete by using AWS CLI: 'aws s3api put-bucket-versioning --versioning-configuration=Status=Enabled,MFADelete=Enabled --bucket=<BUCKET_NAME> --mfa=<MFA_SERIAL_NUMBER>'. Please, also notice that MFA delete can not be used with lifecycle configurations
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_findingIgnore this specific single instance of finding#jit_ignore_type_this_repoIgnore any finding of this type in this repo#jit_undo_ignoreUndo ignore command
| @@ -0,0 +1 @@ | |||
| MY_AZURE_SECRET="AKIAIOSFODNN7EXAMPLE" | |||
There was a problem hiding this comment.
Security control: Secret Detection
Type: Aws-Access-Token
Description: An AWS Keypair was detected
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_findingIgnore this specific single instance of finding#jit_ignore_type_this_repoIgnore any finding of this type in this repo#jit_undo_ignoreUndo ignore command
| @@ -0,0 +1,2 @@ | |||
| import subprocess | |||
| output = subprocess.check_output(f"nslookup2 {my_new_domain}", shell=True, encoding='UTF-8') | |||
There was a problem hiding this comment.
Security control: Static Code Analysis Python
Type: Subprocess Popen With Shell Equals True
Description: subprocess call with shell=True identified, security issue.
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_findingIgnore this specific single instance of finding#jit_ignore_type_this_repoIgnore any finding of this type in this repo#jit_undo_ignoreUndo ignore command
No description provided.