1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

# main.tf — LOM violations fixture
# Triggers all 9 LOM policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# LOM-001 + LOM-002 + LOM-003 — Single region, no validation, no KMS
resource "aws_cloudtrail" "bad_trail" {
  name                          = "bad-trail"
  s3_bucket_name                = "bad-trail-bucket"
  is_multi_region_trail         = false
  include_global_service_events = false
  enable_log_file_validation    = false

  event_selector {
    read_write_type           = "WriteOnly"
    include_management_events = false
  }
}

# LOM-004 + LOM-005 — No KMS, no retention
resource "aws_cloudwatch_log_group" "bad_log_group" {
  name              = "bad-log-group"
  retention_in_days = 7
}

# LOM-006 — VPC with no flow log
resource "aws_vpc" "bad_vpc" {
  cidr_block = "10.0.0.0/16"
}

# No aws_flow_log for bad_vpc = LOM-006 violation

# LOM-007 — ALB with no access logging
resource "aws_lb" "bad_lb" {
  name               = "bad-lb"
  internal           = false
  load_balancer_type = "application"
  subnets            = ["subnet-12345678", "subnet-87654321"]

  access_logs {
    bucket  = ""
    enabled = false
  }
}

# LOM-008 — RDS with no log exports
resource "aws_db_instance" "bad_rds" {
  identifier          = "bad-rds"
  engine              = "mysql"
  engine_version      = "8.0"
  instance_class      = "db.t3.micro"
  allocated_storage   = 20
  username            = "admin"
  password            = "Badpassword123"
  skip_final_snapshot = true
}

# LOM-009 — No Config recorder or delivery channel