TEST PR FOUND RISKS

[alonnalgo]

No description provided.

[github-actions]

  ^{Connectivity Risk Analysis   ❌}

Risk ID	Severity	Summary
I01-NI-SG	Medium	"Any" service can enter your network from Private IPs

Report

I01-NI-SG | "Any" service can enter your network from Private IPs

Description:

Allowing the "Any" service to enter your network is extremely risky since the "Any" service includes many vulnerable services. This is risky even if the traffic is only allowed from business partners or through VPNs.

Recommendation:

Review all the rules that allow inbound traffic with "Any" service, and limit them to those services you actually require.

Details:

[
	{
		"toPort": 8082,
		"fromPort": 8080,
		"ipProtocol": "-1",
		"ipRange": {
			"cidrIp": "172.31.0.0/16"
		}
	}
]

Logs

Output

[
	{
		"riskTitle": "\"Any\" service can enter your network from Private IPs",
		"riskSeverity": "medium",
		"riskDescription": "Allowing the \"Any\" service to enter your network is extremely risky since the \"Any\" service includes many vulnerable services. This is risky even if the traffic is only allowed from business partners or through VPNs.",
		"riskRecommendation": "Review all the rules that allow inbound traffic with \"Any\" service, and limit them to those services you actually require.  ",
		"riskId": "I01-NI-SG",
		"items": [
			{
				"toPort": 8082,
				"fromPort": 8080,
				"ipProtocol": "-1",
				"ipRange": {
					"cidrIp": "172.31.0.0/16"
				}
			}
		]
	}
]

Errors

Risk Analysis Errors

q

^{Terraform Processing   ✔️}

Terraform Log

Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_cloudfront_distribution.cloudfront_distribution will be created
  + resource "aws_cloudfront_distribution" "cloudfront_distribution" {
      + arn                            = (known after apply)
      + caller_reference               = (known after apply)
      + default_root_object            = "index.html"
      + domain_name                    = (known after apply)
      + enabled                        = true
      + etag                           = (known after apply)
      + hosted_zone_id                 = (known after apply)
      + http_version                   = "http2"
      + id                             = (known after apply)
      + in_progress_validation_batches = (known after apply)
      + is_ipv6_enabled                = false
      + last_modified_time             = (known after apply)
      + price_class                    = "PriceClass_All"
      + retain_on_delete               = false
      + status                         = (known after apply)
      + tags_all                       = (known after apply)
      + trusted_key_groups             = (known after apply)
      + trusted_signers                = (known after apply)
      + wait_for_deployment            = true

      + default_cache_behavior {
          + allowed_methods        = [
              + "DELETE",
              + "GET",
              + "HEAD",
              + "OPTIONS",
              + "PATCH",
              + "POST",
              + "PUT",
            ]
          + cached_methods         = [
              + "GET",
              + "HEAD",
            ]
          + compress               = false
          + default_ttl            = 3600
          + max_ttl                = 86400
          + min_ttl                = 0
          + target_origin_id       = "this-is-a-test"
          + trusted_key_groups     = (known after apply)
          + trusted_signers        = (known after apply)
          + viewer_protocol_policy = "redirect-to-https"

          + forwarded_values {
              + headers                 = (known after apply)
              + query_string            = false
              + query_string_cache_keys = (known after apply)

              + cookies {
                  + forward           = "none"
                  + whitelisted_names = (known after apply)
                }
            }
        }

      + logging_config {
          + include_cookies = false
          + prefix          = "logs"
        }

      + origin {
          + connection_attempts = 3
          + connection_timeout  = 10
          + domain_name         = "this-is-a-test"
          + origin_id           = "this-is-a-test/cloudflow"
        }

      + restrictions {
          + geo_restriction {
              + locations        = (known after apply)
              + restriction_type = "none"
            }
        }

      + viewer_certificate {
          + minimum_protocol_version = "TLSv1"
          + ssl_support_method       = "sni-only"
        }
    }

  # aws_security_group.devsecops_test will be created
  + resource "aws_security_group" "devsecops_test" {
      + arn                    = (known after apply)
      + description            = "Display devsecops "
      + egress                 = [
          + {
              + cidr_blocks      = [
                  + "10.20.30.0/24",
                ]
              + description      = ""
              + from_port        = 7654
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 7655
            },
        ]
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = [
                  + "172.31.0.0/16",
                ]
              + description      = "web app"
              + from_port        = 8080
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "-1"
              + security_groups  = []
              + self             = false
              + to_port          = 8082
            },
        ]
      + name                   = "devsecops_test"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name" = "cool_application"
        }
      + tags_all               = {
          + "Name" = "cool_application"
        }
      + vpc_id                 = "vpc-12345678"
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + domain_name = (known after apply)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: /home/runner/work/risk-analysis-customer-repo/risk-analysis-customer-repo/tf-test\tmp\tf.out

To perform exactly these actions, run the following command to apply:
    terraform apply "/home/runner/work/risk-analysis-customer-repo/risk-analysis-customer-repo/tf-test\\tmp\\tf.out"

Errors

// 

Pusher: @alonnalgo, Action: pull_request, Working Directory: 'diff', Workflow: 'Customer Repo CI/CD'