diff --git a/policies/ecc-aws-040-eks_cluster_version_latest.yml b/policies/ecc-aws-040-eks_cluster_version_latest.yml index 074c31030..076eb58ca 100644 --- a/policies/ecc-aws-040-eks_cluster_version_latest.yml +++ b/policies/ecc-aws-040-eks_cluster_version_latest.yml @@ -14,5 +14,9 @@ policies: filters: - type: value key: version - value: "1.29" + value: "1.31" op: lt + - type: value + key: version + value: "1.28" + op: gte diff --git a/policies/ecc-aws-283-elasticsearch_latest_version.yml b/policies/ecc-aws-283-elasticsearch_latest_version.yml index d931553b2..19bc7d1c3 100644 --- a/policies/ecc-aws-283-elasticsearch_latest_version.yml +++ b/policies/ecc-aws-283-elasticsearch_latest_version.yml @@ -9,10 +9,10 @@ policies: - name: ecc-aws-283-elasticsearch_latest_version comment: '010021052000' description: | - ElasticSearch is not using the latest OpenSearch version + OpenSearch is not using the latest engine version resource: elasticsearch filters: - not: - type: value key: ElasticsearchVersion - value: 'OpenSearch_2.11' + value: 'OpenSearch_2.15' diff --git a/policies/ecc-aws-434-mq_broker_latest_version.yml b/policies/ecc-aws-434-mq_broker_latest_version.yml index 822449252..09658bc1a 100644 --- a/policies/ecc-aws-434-mq_broker_latest_version.yml +++ b/policies/ecc-aws-434-mq_broker_latest_version.yml @@ -18,7 +18,7 @@ policies: - type: value key: EngineVersion op: regex - value: 3.12.* + value: 3.13.* - type: value key: EngineType value: RabbitMQ @@ -26,7 +26,7 @@ policies: - type: value key: EngineVersion op: regex - value: 5.17.* + value: 5.18.* - type: value key: EngineType value: ActiveMQ diff --git a/policies/ecc-aws-461-lambda_latest_runtime_environment_version.yml b/policies/ecc-aws-461-lambda_latest_runtime_environment_version.yml index faebdc242..14c16e43d 100644 --- a/policies/ecc-aws-461-lambda_latest_runtime_environment_version.yml +++ b/policies/ecc-aws-461-lambda_latest_runtime_environment_version.yml @@ -15,8 +15,8 @@ policies: - type: value key: PackageType value: Zip - - not: - - type: value - key: Runtime - op: regex - value: '(nodejs20.x|python3.12|java21|dotnetcore3.1|dotnet6|go1.x|ruby3.2)' + - type: value + key: Runtime + op: in + value: [nodejs18.x, python3.11, python3.10, python3.9, java17, java11, java8.al2, dotnet6, ruby3.2, provided.al2] + diff --git a/policies/ecc-aws-497-eks_cluster_oldest_supported_version.yml b/policies/ecc-aws-497-eks_cluster_oldest_supported_version.yml index 6e7bc9b2c..4773db41f 100644 --- a/policies/ecc-aws-497-eks_cluster_oldest_supported_version.yml +++ b/policies/ecc-aws-497-eks_cluster_oldest_supported_version.yml @@ -9,10 +9,10 @@ policies: - name: ecc-aws-497-eks_cluster_oldest_supported_version comment: '010021072000' description: | - EKS cluster is using unsupported version + EKS cluster is using extended support version resource: aws.eks filters: - type: value key: version - value: "1.23" + value: "1.28" op: lt diff --git a/policies/ecc-aws-508-mwaa_latest_version.yml b/policies/ecc-aws-508-mwaa_latest_version.yml index 659a0d017..a8a6936c7 100644 --- a/policies/ecc-aws-508-mwaa_latest_version.yml +++ b/policies/ecc-aws-508-mwaa_latest_version.yml @@ -15,4 +15,4 @@ policies: - not: - type: value key: AirflowVersion - value: '2.9.2' + value: '2.10.1' diff --git a/policies/ecc-aws-536-lambda_function_settings_check.yml b/policies/ecc-aws-536-lambda_function_settings_check.yml index 02564de93..d49fa6bd7 100644 --- a/policies/ecc-aws-536-lambda_function_settings_check.yml +++ b/policies/ecc-aws-536-lambda_function_settings_check.yml @@ -9,7 +9,7 @@ policies: - name: ecc-aws-536-lambda_function_settings_check comment: '010028030400' description: | - Lambda functions should not use no longer supported runtimes + Lambda functions should not use deprecated runtimes resource: aws.lambda filters: - type: value @@ -19,4 +19,4 @@ policies: - type: value key: Runtime op: in - value: [dotnet8, dotnet6, java21, java17, java11, java8.al2, nodejs20.x, nodejs18.x, nodejs16.x, python3.12, python3.11, python3.10, python3.9, python3.8, ruby3.3, ruby3.2] + value: [nodejs20.x, nodejs18.x, python3.12, python3.11, python3.10, python3.9, java21, java17, java11, java8.al2, dotnet8, dotnet6, ruby3.3, ruby3.2, provided.al2023, provided.al2] diff --git a/policies/ecc-aws-549-ec2_instance_previous_generation.yml b/policies/ecc-aws-549-ec2_instance_previous_generation.yml index 6adefe277..4bd8f77da 100755 --- a/policies/ecc-aws-549-ec2_instance_previous_generation.yml +++ b/policies/ecc-aws-549-ec2_instance_previous_generation.yml @@ -19,4 +19,4 @@ policies: - type: value key: InstanceType op: regex - value: '(m1|m2|m3|m4|t1|c1|c2|c3|i2|cr1|r3|r4|hs1|g2|a1|d2).[^\s]+' + value: '(m1|m2|m3|m4|t1|c1|c2|c3|c4|cc2|i2|cr1|r3|r4|hs1|g2|a1|d2).[^\s]+' diff --git a/policies/ecc-aws-598-redshift_instance_generation.yml b/policies/ecc-aws-598-redshift_instance_generation.yml index 9f4887b03..ba2bafc36 100644 --- a/policies/ecc-aws-598-redshift_instance_generation.yml +++ b/policies/ecc-aws-598-redshift_instance_generation.yml @@ -15,4 +15,4 @@ policies: - type: value key: NodeType op: regex - value: '(dc1|ds2).[^\s]+' + value: '(dc1|ds1|ds2).[^\s]+' diff --git a/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/green/lb.tf b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/green/lb.tf index 016db0704..776083b70 100644 --- a/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/green/lb.tf +++ b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/green/lb.tf @@ -13,9 +13,14 @@ data "aws_ami" "this" { } } +data "aws_availability_zones" "this" { + state = "available" +} + resource "aws_elb" "this" { name = "elb-013-http-green" - availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"] + security_groups = [aws_security_group.this.id] + availability_zones = [data.aws_availability_zones.this.names[0], data.aws_availability_zones.this.names[1]] listener { instance_port = 8000 @@ -32,6 +37,26 @@ resource "aws_elb" "this" { connection_draining_timeout = 400 } +resource "aws_load_balancer_policy" "this" { + load_balancer_name = aws_elb.this.name + policy_name = "policygreen" + policy_type_name = "SSLNegotiationPolicyType" + + policy_attribute { + name = "Reference-Security-Policy" + value = "ELBSecurityPolicy-TLS-1-2-2017-01" + } +} + +resource "aws_load_balancer_listener_policy" "this" { + load_balancer_name = aws_elb.this.name + load_balancer_port = 443 + + policy_names = [ + aws_load_balancer_policy.this.policy_name, + ] +} + resource "tls_private_key" "this" { algorithm = "RSA" } @@ -57,23 +82,3 @@ resource "aws_acm_certificate" "this" { private_key = tls_private_key.this.private_key_pem certificate_body = tls_self_signed_cert.this.cert_pem } - -resource "aws_load_balancer_policy" "this" { - load_balancer_name = aws_elb.this.name - policy_name = "policygreen" - policy_type_name = "SSLNegotiationPolicyType" - - policy_attribute { - name = "Reference-Security-Policy" - value = "ELBSecurityPolicy-TLS-1-2-2017-01" - } -} - -resource "aws_load_balancer_listener_policy" "this" { - load_balancer_name = aws_elb.this.name - load_balancer_port = 443 - - policy_names = [ - aws_load_balancer_policy.this.policy_name, - ] -} \ No newline at end of file diff --git a/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/green/vpc.tf b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/green/vpc.tf new file mode 100644 index 000000000..fbc5e0244 --- /dev/null +++ b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/green/vpc.tf @@ -0,0 +1,12 @@ +data "aws_vpc" "default" { + default = true +} + +resource "aws_security_group" "this" { + name = "013_security_group_green" + vpc_id = data.aws_vpc.default.id + + tags = { + Name = "013_security_group_green" + } +} \ No newline at end of file diff --git a/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/red/lb.tf b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/red/lb.tf index ec29af2b3..d3d4817b0 100644 --- a/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/red/lb.tf +++ b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/red/lb.tf @@ -15,7 +15,7 @@ data "aws_ami" "this" { resource "aws_elb" "this" { name = "elb-013-http-red" - availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"] + availability_zones = [data.aws_availability_zones.this.names[0], data.aws_availability_zones.this.names[1]] listener { instance_port = 8000 @@ -30,6 +30,14 @@ resource "aws_elb" "this" { idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 + security_groups = [aws_security_group.this.id] +} + +resource "aws_load_balancer_listener_policy" "this" { + load_balancer_name = aws_elb.this.name + load_balancer_port = 443 + + policy_names = ["ELBSecurityPolicy-2016-08"] } resource "tls_private_key" "this" { diff --git a/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/red/vpc.tf b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/red/vpc.tf new file mode 100644 index 000000000..04c171735 --- /dev/null +++ b/terraform/ecc-aws-013-remove_weak_ciphers_for_clb/red/vpc.tf @@ -0,0 +1,16 @@ +data "aws_vpc" "default" { + default = true +} + +resource "aws_security_group" "this" { + name = "013_security_group_red" + vpc_id = data.aws_vpc.default.id + + tags = { + Name = "013_security_group_red" + } +} + +data "aws_availability_zones" "this" { + state = "available" +} \ No newline at end of file diff --git a/terraform/ecc-aws-040-eks_cluster_version_latest/green/eks.tf b/terraform/ecc-aws-040-eks_cluster_version_latest/green/eks.tf index 97edb81f2..e8c1f5fa0 100644 --- a/terraform/ecc-aws-040-eks_cluster_version_latest/green/eks.tf +++ b/terraform/ecc-aws-040-eks_cluster_version_latest/green/eks.tf @@ -1,7 +1,7 @@ resource "aws_eks_cluster" "this" { name = "040_eks_cluster_green" role_arn = aws_iam_role.this.arn - version = "1.29" + version = "1.31" vpc_config { subnet_ids = [aws_subnet.subnet1.id, aws_subnet.subnet2.id] @@ -14,7 +14,6 @@ resource "aws_eks_cluster" "this" { resource "aws_iam_role" "this" { name = "eks-040-cluster-green" - assume_role_policy = <