1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101

# main.tf — CMP violations fixture
# Triggers all 11 CMP policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# CMP-001 + CMP-002 + CMP-003 — No IMDSv2, hop limit not 1, public IP
resource "aws_instance" "bad_instance" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.micro"

  associate_public_ip_address = true

  metadata_options {
    http_tokens                 = "optional"
    http_put_response_hop_limit = 2
  }

  ebs_block_device {
    device_name = "/dev/xvdb"
    encrypted   = false
  }
}

# CMP-004 — Subnet auto-assigns public IPs
resource "aws_subnet" "bad_subnet" {
  vpc_id                  = "vpc-12345678"
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true
}

# CMP-005 + CMP-006 + CMP-007 — Unrestricted SSH, RDP, and high-risk ports
resource "aws_security_group" "bad_sg" {
  name   = "bad-sg"
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# CMP-008 — Default security group has rules
resource "aws_default_security_group" "bad_default_sg" {
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# CMP-009 — Unencrypted EBS volume
resource "aws_ebs_volume" "bad_volume" {
  availability_zone = "ap-south-1a"
  size              = 20
  encrypted         = false
}

# CMP-010 — EBS default encryption disabled
resource "aws_ebs_encryption_by_default" "bad_ebs_default" {
  enabled = false
}

# CMP-011 — Privileged ECS container
resource "aws_ecs_task_definition" "bad_task" {
  family = "bad-task"
  container_definitions = jsonencode([{
    name       = "bad-container"
    image      = "nginx:latest"
    privileged = true
  }])
}