snyk/iac-security

Infrastructure as Code Security

Comprehensive security scanning for Infrastructure as Code to catch misconfigurations before they become production vulnerabilities.

Core Principle: Security issues are cheaper to fix in code than in production.

---

Quick Start

1. Identify IaC files (Terraform, K8s, CloudFormation, ARM)
2. Run snyk_iac_scan on the directory
3. Analyze misconfigurations by severity
4. Provide secure configuration alternatives

---

Supported IaC Formats

| Platform | File Types | |----------|-----------| | Terraform | .tf, .tf.json, .tfvars | | Terraform Plan | JSON plan output (terraform show -json) | | Kubernetes | .yaml / .yml with apiVersion + kind | | Helm | Chart templates (requires Chart.yaml) | | AWS CloudFormation | .json / .yaml with AWSTemplateFormatVersion | | Azure ARM | .json with $schema ARM URL | | Serverless Framework | serverless.yml |

---

Phase 1: Discovery

Goal: Identify all IaC files that need scanning.

Check for these indicators to confirm IaC type:

• Terraform: .tf files, terraform.tfstate, provider blocks
• Kubernetes: YAML with apiVersion/kind, directories named k8s, manifests
• CloudFormation: AWSTemplateFormatVersion key, Resources section with AWS types
• Azure ARM: $schema containing deploymentTemplate

Then determine scan scope: single file, directory, or recursive.

---

Phase 2: Execute Scan

Goal: Run appropriate IaC security scan.

Basic Scan

Run snyk_iac_scan with:
- path: <directory or file path>

Terraform with Variables

Run snyk_iac_scan with:
- path: <terraform directory>
- var_file: <path to .tfvars if using variables>

Terraform Plan (more accurate)

terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json

Run snyk_iac_scan with:
- path: tfplan.json
- scan: "planned-values"  # or "resource-changes"

Custom Rules

Run snyk_iac_scan with:
- path: <directory>
- rules: <path to custom rules bundle>

---

Phase 3: Analyze Results

Goal: Understand and categorize misconfigurations.

Severity Assessment

| Severity | Risk Level | Examples | |----------|------------|----------| | Critical | Immediate risk | Public S3, open security groups | | High | Significant risk | Missing encryption, excessive perms | | Medium | Moderate risk | Missing logging, broad IAM | | Low | Best practice | Missing tags, suboptimal config |

Generate Summary

## IaC Security Scan Results

### Overview
| Severity | Count | Status |
|----------|-------|--------|
| Critical | X | 🔴 Block |
| High | Y | 🟠 Fix Required |
| Medium | Z | 🟡 Recommended |
| Low | W | 🔵 Optional |

### Critical Issues
| Resource | Issue | Location |
|----------|-------|----------|
| aws_s3_bucket.data | Public access enabled | main.tf:45 |
| aws_security_group.web | Open to 0.0.0.0/0 on port 22 | network.tf:23 |

### High Issues
| Resource | Issue | Location |
|----------|-------|----------|
| aws_rds_instance.db | Encryption not enabled | database.tf:12 |

Categorize by Domain

Group issues for easier remediation:

• Network Security: Security groups, Network ACLs, Load balancer config, VPC settings
• Data Protection: Encryption at rest/in transit, Backup configuration, Key management
• Access Control: IAM policies, Service accounts, RBAC settings, API permissions
• Logging & Monitoring: CloudTrail/audit logs, Access logging, Alerting config

---

Phase 4: Remediation

Goal: Provide secure configuration fixes. Apply the pattern below to each finding; representative examples follow.

Terraform Fixes

S3 Bucket — Block Public Access

# Insecure
resource "aws_s3_bucket" "data" {
  bucket = "my-bucket"
}

# Secure
resource "aws_s3_bucket" "data" {
  bucket = "my-bucket"
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Security Group — Restrict Access

# Insecure - open to world
resource "aws_security_group" "web" {
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]  # BAD
  }
}

# Secure - restricted to VPN/internal range
resource "aws_security_group" "web" {
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

RDS — Enable Encryption

# Secure
resource "aws_db_instance" "main" {
  engine              = "postgres"
  instance_class      = "db.t3.micro"
  storage_encrypted   = true
  kms_key_id          = aws_kms_key.rds.arn
  deletion_protection = true
}

Kubernetes Fixes

Pod Security — Non-Root User & Resource Limits

apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
  containers:
  - name: app
    image: myapp
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
          - ALL
    resources:
      limits:
        cpu: "500m"
        memory: "512Mi"
      requests:
        cpu: "200m"
        memory: "256Mi"

Network Policy — Restrict Traffic

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-network-policy
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: allowed-namespace

CloudFormation Fixes

S3 Bucket — Encryption & Public Access Block

Resources:
  DataBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref DataBucketKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

---

Phase 5: Verification

Goal: Confirm fixes are effective.

Re-scan After Changes

Run snyk_iac_scan with:
- path: <same directory>

For Terraform, regenerate and scan the plan:

terraform plan -out=tfplan.new
terraform show -json tfplan.new > tfplan.new.json

Report Improvements

## Fix Verification

| Severity | Before | After | Change |
|----------|--------|-------|--------|
| Critical | 2 | 0 | -2 ✅ |
| High | 5 | 1 | -4 ✅ |
| Medium | 8 | 6 | -2 ✅ |

### Remaining Issues
- 1 High: Third-party module - opened issue
- 6 Medium: Accepted risk (documented)

---

Best Practices

Prevention

1. Scan in CI/CD: Fail builds with critical issues
2. Pre-commit hooks: Catch issues before commit
3. Module security: Scan reusable modules
4. Policy as code: Define custom rules for org standards

Policy File Usage

Create .snyk to manage exceptions:

ignore:
  SNYK-CC-TF-123:
    - '*':
        reason: 'Accepted risk - internal development environment'
        expires: 2025-06-01
        created: 2024-01-15

Custom Rules

For organization-specific requirements:

1. Write rules in Rego (OPA) format
2. Bundle as .tar.gz
3. Pass to scan with --rules option

---

Error Handling

| Error | Solutions | |-------|-----------| | Could not read Terraform state | Run terraform init; check state backend; scan .tf files directly | | Invalid HCL syntax | Run terraform validate; check syntax; ensure all variables are defined | | Could not parse plan file | Regenerate with terraform show -json; check Terraform version compatibility; verify JSON validity |

---

Constraints

1. Scan before apply: Never apply unscanned IaC
2. Block on critical: Critical issues must be fixed
3. Document exceptions: Use .snyk policy for accepted risks
4. Validate plans: Prefer plan scanning over file scanning for Terraform
5. Continuous monitoring: Re-scan when dependencies update