quiet: true framework: terraform evaluate-variables: true download-external-modules: true external-checks-dir: - policies/simple - policies/advanced skip-check: - CKV_AWS_23 # Ensure every security groups rule has a description # Reason for disabling: Naming conventions for our security groups include # the purpose of the security group, and rules are self-explanatory for # their purpose. - CKV_AWS_150 # Ensure that Load Balancer has deletion protection enabled # Reason for disabling: Users do not have access to delete Load Balancers, # only Atlantis does, which requires deletion protection to be off. - CKV_AWS_131 # Ensure that ALB drops HTTP headers # Reason for disabling: This requires dropping all 'invalid' headers, which # potentially includes our custom headers. To be investigated. - CKV_AWS_51 # Ensure ECR Image Tags are immutable # Reason for disabling: The current workflow requires the latest tag to be # mutable to push new image updates from Jenkins pipelines. - CKV_AWS_66 # Ensure that CloudWatch Log Group specifies retention days # Reason for disabling: Currently, we don't have a CloudWatch log retention # period defined for any of the infrastructure parts. To be discussed. - CKV_AWS_158 # Ensure that CloudWatch Log Group is encrypted by KMS # Reason for disabling: To enable KMS encryption for CloudWatch logs, we # first need to introduce KMS key permissions for DataDog Forwarder lambda # and test it. To be discussed with the security team. - CKV_AWS_144 # Ensure that S3 bucket has cross-region replication enabled # Reason for disabling: We don't use S3 cross-region replication for # disaster recovery purposes. - CKV2_AWS_8 # Ensure that RDS clusters has backup plan of AWS Backup # Reason for disabling: We use RDS snapshots for disaster recovery instead # of the AWS Backup service. - CKV2_AWS_18 # Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup # Reason for disabling: We don't have a working AWS Backup solution for EFS disaster recovery. - CKV_AWS_162 # Ensure RDS cluster has IAM authentication enabled # Reason for disabling: We do not use IAM authentication to access RDS # databases. - CKV_AWS_128 # Ensure that an Amazon RDS Clusters have AWS Identity and # Access Management (IAM) authentication enabled # Reason for disabling: We do not use IAM authentication to access RDS # databases. - CKV_AWS_139 # Ensure that RDS clusters have deletion protection enabled # Reason for disabling: There is no need to enable deletion protection for # dev and qa environments. We will create a custom policy to enforce this # for production only. - CKV_AWS_149 # Ensure that Secrets Manager secret is encrypted using KMS CMK # Reason for disabling: We do not force using KMS CMK for Secrets Manager, # therefore the AWS-managed KMS key is allowed. Also, this check does not # work with the terraform-secrets-manager module. - CKV2_AWS_14 # Ensure that IAM groups includes at least one IAM user # Reason for disabling: Checkov implies that AWS users, groups, and group # membership resources exist in the same terraform project. We create users # independently but manage their groups and group membership in different # terraform projects. - CKV2_AWS_21 # Ensure that all IAM users are members of at least one IAM group # Reason for disabling: Checkov implies that AWS users, groups, and group # membership resources exist in the same terraform project. We create users # independently but manage their groups and group membership in different # terraform projects. - CKV2_AWS_5 # Ensure that Security Groups are attached to another resource # Reason for disabling: We want to avoid this finding being triggered in # terraform projects that use the terraform-lambda module. The module # accepts security group IDs in the dynamic statement, which Checkov # doesn't parse correctly. - CKV_AWS_40 # Ensure IAM policies are attached only to groups or roles # Reason for disabling: We attach IAM policies to IAM users directly in # several cases, such as SWF workloads and integration testing. Making an # IAM group for a single user isn't constructive. - CKV_AWS_73 # Ensure API Gateway has X-Ray tracing enabled # Reason for disabling: We use DataDog instead of X-Ray for observability. - CKV_AWS_120 # Ensure API gateway caching is enabled # Reason for disabling: Some of our services do not use caching at # API Gateway level. - CKV_AWS_225 # Ensure API Gateway method setting caching is enabled # Reason for disabling: Some of our services do not use caching at # API Gateway level. - CKV2_AWS_32 # Ensure CloudFront distribution has a strict security headers # policy attached # Reason for disabling: Recommended policy may break some of our web pages. # Also, it has 6 recommended settings that aren't flexible. We're going to # replace it with custom policies. - CKV_AWS_259 # Ensure CloudFront response header policy enforces Strict # Transport Security # Reason for disabling: We have custom policies defined for the CloudFront # response headers policy with more suitable settings. Also, this finding # duplicates the Strict Transport Security configuration from CKV2_AWS_32. - CKV2_AWS_23 # Route53 A Record has Attached Resource # Reason for disabling: We have on-prem resources which we can't refer to # as data sources. So the only way is to directly specify an IP address for # an A record. - CKV_AWS_272 # Ensure AWS Lambda function is configured to validate code-signing # Reason for disabling: We don't require code-signign for Lambda functions. - CKV_AWS_273 # Ensure access is controlled through SSO and not AWS IAM defined users # Reason for disabling: not compliant with our approach - CKV_AWS_285 # Ensure State Machine has execution history logging enabled # Reason for disabling: Currently, we don't provide suitable examples of # State Machine logging. We'll enable this finding once we add them or move # State Machines to a module. - CKV2_AWS_52 # Ensure AWS ElasticSearch/OpenSearch Fine-grained access # control is enabled # Reason for disabling: We're switching from fine-grained access # controls to IAM authentication/authorization with request signing. - CKV_AWS_355 # Ensure no IAM policies documents allow "*" as a statement\'s resource - CKV_AWS_356 # Ensure IAM policies limit resource access # Reason for disabling: These checks have a simple restriction from using # "*" as a resource in policy documents, which is too conservative as there # are many API actions that require "*" as the only possible resource # (ListAllMyBuckets" for example). - CKV2_AWS_62 # Ensure S3 buckets should have event notifications enabled # Reason for disabling: We don't use S3 event notifications to track S3 # object operations, we use Eventbridge/CloudTrail integration instead. - CKV2_AWS_57 # Ensure Secrets Manager secrets should have automatic rotation enabled # Reason for disabling: We don't have globally implemented secret rotation # flow yet. - CKV_AWS_353 # Ensure that RDS instances have performance insights enabled # Reason for disabling: It's fine to have this feature disabled for test # RDS instances. Also, this finding can't be blocked on the module level # because of the software bug. - CKV_AWS_354 # Ensure RDS Performance Insights are encrypted using KMS CMKs # Reason for disabling: Although RDS Performance Insights may potentially # contain sensitive data, adding KMS CMK encryption will add a complexity # level to accessing Insights data by engineers. Also, this finding can't # be blocked on the module level because of the software bug. - CKV_AWS_382 # Ensure no security groups allow egress from 0.0.0.0:0 to port -1 # Reason for disabling: It's necessary to allow all egress traffic - CKV_TF_1 # Ensure Terraform module sources use a commit hash # Reason for disabling: We use tags instead of commit hashes for versioning. # This rule would lead to false positives with our local modules and disrupt # our established versioning strategy. Disabling this rule prevents # unnecessary changes and maintains our efficient workflow. - CKV_TF_3 # Ensure state files are locked # Reason for disabling: Atlantis handles state file locking - CKV2_AWS_64 # Ensure KMS key Policy is defined # Reason for disabling: Our security strategy does not mandate the use of KMS policies. # By disabling this rule, we accommodate different encryption strategies # and provide flexibility to our development teams. - CKV2_AWS_47 # Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability # Reason for disabling: This rule requires the AWSManagedRulesAnonymousIpList rule group to be configured on WAFs, which blocks legitimate traffic. # We use a custom rule group for IP blocks. - CKV2_AWS_76 # Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability # Reason for disabling: See CKV2_AWS_47. - CKV2_AWS_77 # Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability # Reason for disabling: See CKV2_AWS_47.