1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

# main.tf — CMP compliance fixture
# Produces zero CMP policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# CMP-001 + CMP-002 + CMP-003 + CMP-009 — IMDSv2, hop limit 1, no public IP, encrypted EBS
resource "aws_instance" "good_instance" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.micro"

  associate_public_ip_address = false

  metadata_options {
    http_tokens                 = "required"
    http_put_response_hop_limit = 1
  }

  ebs_block_device {
    device_name = "/dev/xvdb"
    encrypted   = true
  }
}

# CMP-004 — No public IP auto-assignment
resource "aws_subnet" "good_subnet" {
  vpc_id                  = "vpc-12345678"
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = false
}

# CMP-005 + CMP-006 + CMP-007 — Restricted ingress only
resource "aws_security_group" "good_sg" {
  name   = "good-sg"
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

# CMP-008 — Default security group with no rules
resource "aws_default_security_group" "good_default_sg" {
  vpc_id = "vpc-12345678"
}

# CMP-009 — Encrypted EBS volume
resource "aws_ebs_volume" "good_volume" {
  availability_zone = "ap-south-1a"
  size              = 20
  encrypted         = true
}

# CMP-010 — EBS default encryption enabled
resource "aws_ebs_encryption_by_default" "good_ebs_default" {
  enabled = true
}

# CMP-011 — Non-privileged ECS container
resource "aws_ecs_task_definition" "good_task" {
  family = "good-task"
  container_definitions = jsonencode([{
    name       = "good-container"
    image      = "nginx:latest"
    privileged = false
  }])
}