1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

# main.tf — DAT violations fixture
# Triggers all 9 DAT policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# DAT-001 + DAT-002 + DAT-003 + DAT-004 + DAT-005
resource "aws_db_instance" "bad_rds" {
  identifier                 = "bad-rds"
  engine                     = "mysql"
  engine_version             = "8.0"
  instance_class             = "db.t3.micro"
  allocated_storage          = 20
  username                   = "admin"
  password                   = "Badpassword123"
  publicly_accessible        = true
  storage_encrypted          = false
  deletion_protection        = false
  auto_minor_version_upgrade = false
  skip_final_snapshot        = true
}

# DAT-006 — DynamoDB without PITR
resource "aws_dynamodb_table" "bad_table" {
  name         = "bad-table"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "id"

  attribute {
    name = "id"
    type = "S"
  }

  point_in_time_recovery {
    enabled = false
  }
}

# DAT-007 + DAT-008 — Redshift publicly accessible, no logging resource
resource "aws_redshift_cluster" "bad_redshift" {
  cluster_identifier  = "bad-redshift"
  database_name       = "baddb"
  master_username     = "admin"
  master_password     = "Badpassword123"
  node_type           = "dc2.large"
  cluster_type        = "single-node"
  publicly_accessible = true
  skip_final_snapshot = true
}

# No aws_redshift_logging resource = DAT-008 violation

# DAT-009 — ElastiCache without encryption
resource "aws_elasticache_replication_group" "bad_redis" {
  replication_group_id       = "bad-redis"
  description                = "bad redis"
  node_type                  = "cache.t3.micro"
  num_cache_clusters         = 1
  transit_encryption_enabled = false
  at_rest_encryption_enabled = false
}