Project: KICS (Provisioning / Security & Compliance)
File: 0b93729a-d882-4803-bdc3-ac429a21f158.md

title: EC2 Instance Using API Keys hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 0b93729a-d882-4803-bdc3-ac429a21f158 Query name: EC2 Instance Using API Keys Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Access Control URL: EC2 instances should use roles to be granted access to other AWS services<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive1" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } user_data = <<EOF apt-get install -y awscli export AWSACCESSKEYID=youraccesskeyid_here export AWSSECRETACCESSKEY=yoursecretaccesskey_here EOF credit_specification { cpu_credits = "unlimited" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" user_data = <<EOF apt-get install -y awscli export AWSACCESSKEYID=youraccesskeyid_here export AWSSECRETACCESSKEY=yoursecretaccesskey_here EOF tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" userdatabase64 = var.initawscli tags = { Terraform = "true" Environment = "dev" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="1" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" userdatabase64 = base64encode("apt-get install -y awscli; export AWSACCESSKEYID=youraccesskeyidhere; export AWSSECRETACCESSKEY=yoursecretaccesskeyhere") tags = { Terraform = "true" Environment = "dev" } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="5" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive2" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } user_data = <<EOT apt-get install -y awscli cat << EOF > ~/.aws/config [default] awsaccesskey_id = somekey awssecretaccess_key = somesecret EOF EOT credit_specification { cpu_credits = "unlimited" } } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="5" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive3" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } user_data = <<EOT apt-get install -y awscli cat << EOF > ~/.aws/credentials [default] awsaccesskey_id = somekey awssecretaccess_key = somesecret EOF EOT credit_specification { cpu_credits = "unlimited" } } ``` </details> <details><summary>Positive test num. 7 - tf file</summary> ```tf hl_lines="5" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive4" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } userdatabase64 = var.initawscli credit_specification { cpu_credits = "unlimited" } } ``` </details> <details><summary>Positive test num. 8 - tf file</summary> ```tf hl_lines="5" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive5" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } userdatabase64 = base64encode("apt-get install -y awscli; export AWSACCESSKEYID=youraccesskeyidhere; export AWSSECRETACCESSKEY=yoursecretaccesskeyhere") credit_specification { cpu_credits = "unlimited" } } ``` </details> <details><summary>Positive test num. 9 - tf file</summary> ```tf hl_lines="5" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive6" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } user_data = <<EOT repo_update: true repo_upgrade: all packages: awscli runcmd: [ sh, -c, "echo export AWSACCESSKEY_ID=my-key-id >>

] [ sh, -c, "echo export AWSSECRETACCESS_KEY=my-secret >> ~/.bashrc" ] EOT credit_specification { cpu_credits = "unlimited" } } ``` </details> <details><summary>Positive test num. 10 - tf file</summary> ```tf hl_lines="13" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive7" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } provisioner "remote-exec" { inline = [ "wget -O - http://config.remote.server.com/aws-credentials > ~/.aws/credentials;" ] } credit_specification { cpu_credits = "unlimited" } } ``` </details> <details><summary>Positive test num. 11 - tf file</summary> ```tf hl_lines="13" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive8" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } provisioner "file" { source = "conf/aws-credentials" destination = "~/.aws/credentials" } } ``` </details> <details><summary>Positive test num. 12 - tf file</summary> ```tf hl_lines="13" provider "aws" { region = "us-east-1" } resource "aws_instance" "positive9" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } provisioner "remote-exec" { inline = [ "echo export AWSACCESSKEY_ID=my-key-id >> ~/.bashrc", "echo export AWSSECRETACCESS_KEY=my-secret >> ~/.bashrc" ] } credit_specification { cpu_credits = "unlimited" } } ``` </details> ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } resource "awsiamrolepolicyattachment" "test_attach" { roles = [awsiamrole.test_role.name] policyarn = awsiampolicy.testpolicy.arn } resource "awsiampolicy" "test_policy" { name = "test_policy" description = "test policy" path = "/" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:Get*", "s3:List*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsiamrole" "test_role" { name = "test_role" path = "/" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awsiaminstanceprofile" "testprofile" { name = "test_profile" role = awsiamrole.role.name } resource "aws_instance" "negative1" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } iaminstanceprofile = awsiaminstanceprofile.testprofile.name credit_specification { cpu_credits = "unlimited" } } ``` ```tf title="Negative test num. 2 - tf file" module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Negative test num. 3 - tf file" provider "aws" { region = "us-east-1" } resource "awsiamrolepolicyattachment" "test_attach" { roles = [awsiamrole.test_role.name] policyarn = awsiampolicy.testpolicy.arn } resource "awsiampolicy" "test_policy" { name = "test_policy" description = "test policy" path = "/" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:Get*", "s3:List*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsiamrole" "test_role" { name = "test_role" path = "/" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awsiaminstanceprofile" "testprofile" { name = "test_profile" role = awsiamrole.role.name } resource "aws_instance" "negative3" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" tags = { Name = "test" } iaminstanceprofile = awsiaminstanceprofile.testprofile.name credit_specification { cpu_credits = "unlimited" } user_data = <<-EOF apt-get update EOF } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "ec2_instance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnet_id = "subnet-eddcdzz4" tags = { Terraform = "true" Environment = "dev" } user_data = <<-EOF apt-get update EOF } ``` </details>