1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

# main.tf — GAC new policy violations fixture
# Triggers GAC-003, GAC-008, GAC-012, GAC-013, GAC-014,
# GAC-015, GAC-016, GAC-022, GAC-023, GAC-025, GAC-026

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# GAC-025 — No default_tags
provider "aws" {
  region = "ap-south-1"
}

# GAC-026 — Resources do not have the baseline tags attached
# Fires once per taggable resource in this file

# GAC-003 — S3 bucket with versioning disabled
resource "aws_s3_bucket" "bad_bucket" {
  bucket = "bad-gac-bucket"
}

resource "aws_s3_bucket_versioning" "bad_versioning" {
  bucket = aws_s3_bucket.bad_bucket.id
  versioning_configuration {
    status = "Suspended"
  }
}

# GAC-008 — EBS snapshot shared publicly
# Cannot be checked without actual snapshot
# Will be injected manually in the fixture

# GAC-012 — RDS with insufficient backup retention
resource "aws_db_instance" "bad_rds" {
  identifier              = "bad-gac-rds"
  engine                  = "mysql"
  engine_version          = "8.0"
  instance_class          = "db.t3.micro"
  allocated_storage       = 20
  username                = "admin"
  password                = "Badpassword123"
  skip_final_snapshot     = true
  backup_retention_period = 7
}

# GAC-013 — RDS snapshot shared publicly
# Cannot be checked without actual snapshot
# Will be injected manually in the fixture

# GAC-014 — IAM policy with admin wildcard
resource "aws_iam_policy" "bad_admin_policy" {
  name = "bad-admin-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "*"
      Resource = "*"
    }]
  })
}

# GAC-015 — IAM role with wildcard principal
resource "aws_iam_role" "bad_role" {
  name = "bad-gac-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "sts:AssumeRole"
    }]
  })
}

# GAC-016 — Weak password policy
resource "aws_iam_account_password_policy" "bad_password_policy" {
  minimum_password_length      = 8
  require_symbols              = false
  require_numbers              = false
  require_uppercase_characters = false
  require_lowercase_characters = false
  password_reuse_prevention    = 5
  max_password_age             = 180
}

# GAC-022 — CloudFront with old TLS
resource "aws_cloudfront_distribution" "bad_cf" {
  enabled = true

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "bad-origin"
    viewer_protocol_policy = "redirect-to-https"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
    minimum_protocol_version       = "TLSv1"
  }

  origin {
    domain_name = "example.com"
    origin_id   = "bad-origin"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  restrictions {
    geo_restriction { restriction_type = "none" }
  }
}

# GAC-023 — EKS with public endpoint open to all
resource "aws_eks_cluster" "bad_eks" {
  name     = "bad-eks"
  role_arn = "arn:aws:iam::123456789012:role/eks-role"

  vpc_config {
    subnet_ids              = ["subnet-12345678"]
    endpoint_public_access  = true
    endpoint_private_access = false
    public_access_cidrs     = ["0.0.0.0/0"]
  }
}