1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

# main.tf — EKM violations fixture
# Triggers all 8 EKM policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# EKM-001 + EKM-002 — No rotation, short deletion window
resource "aws_kms_key" "bad_key" {
  description              = "bad key"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"
  enable_key_rotation      = false
  deletion_window_in_days  = 7
}

# EKM-003 — Broad KMS decrypt in IAM policy
resource "aws_iam_policy" "bad_kms_policy" {
  name = "bad-kms-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["kms:Decrypt"]
      Resource = "*"
    }]
  })
}

# EKM-004 — KMS key policy grants kms:* to root without condition
# deletion_window and rotation set correctly so only EKM-004 fires
resource "aws_kms_key" "bad_root_key" {
  description              = "bad root key"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"
  enable_key_rotation      = true
  deletion_window_in_days  = 30
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::123456789012:root" }
      Action    = "kms:*"
      Resource  = "*"
    }]
  })
}

# EKM-005 — S3 encryption using AES256 instead of KMS CMK
resource "aws_s3_bucket" "bad_bucket" {
  bucket = "bad-ekm-bucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "bad_sse" {
  bucket = aws_s3_bucket.bad_bucket.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# EKM-006 — EBS default encryption disabled
resource "aws_ebs_encryption_by_default" "bad_ebs" {
  enabled = false
}

# EKM-007 — Secret with no rotation
resource "aws_secretsmanager_secret" "bad_secret" {
  name = "bad-secret"
}

# No aws_secretsmanager_secret_rotation = EKM-007 violation

# EKM-008 — Weak RSA key
resource "aws_acm_certificate" "bad_cert" {
  domain_name       = "bad.example.com"
  validation_method = "DNS"
  key_algorithm     = "RSA_1024"
}