Project: KICS (Provisioning / Security & Compliance)
File: 443488f5-c734-460b-a36d-5b3f330174dc.md

title: User Data Contains Encoded Private Key hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 443488f5-c734-460b-a36d-5b3f330174dc Query name: User Data Contains Encoded Private Key Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: User Data should not contain a base64 encoded private key. If so, anyone can decode the private key easily<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" resource "awslaunchconfiguration" "positive1" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" userdatabase64 = "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpzb21lS2V5" # someKey lifecycle { createbeforedestroy = true } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="11" module "positive2" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] userdatabase64 = "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpzb21lS2V5" ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true }, ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" }, ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="11" module "positive3" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] userdatabase64 = "LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZIEJMT0NLLS0tLS0=" ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true }, ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" }, ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` ```tf title="Negative test num. 1 - tf file" resource "awslaunchconfiguration" "negative1" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" lifecycle { createbeforedestroy = true } } resource "awslaunchconfiguration" "negative2" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" userdatabase64 = "" lifecycle { createbeforedestroy = true } } resource "awslaunchconfiguration" "negative3" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" userdatabase64 = "dGVzdA==" lifecycle { createbeforedestroy = true } } resource "awslaunchconfiguration" "negative4" { imageid = data.awsami.ubuntu.id instance_type = "m4.large" spot_price = "0.001" userdatabase64 = null lifecycle { createbeforedestroy = true } } ``` ```tf title="Negative test

2 - tf file" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true }, ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" }, ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` ```tf title="Negative test num. 3 - tf file" module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] userdatabase64 = "" ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true }, ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" }, ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] userdatabase64 = "dGVzdA==" ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true }, ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" }, ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf module "asg" { source = "terraform-aws-modules/autoscaling/aws" version = "1.0.4" lc_name = "example-lc" image_id = "ami-ebd02392" instance_type = "t2.micro" security_groups = ["sg-12345678"] userdatabase64 = null ebsblockdevice = [ { device_name = "/dev/xvdz" volume_type = "gp2" volume_size = "50" deleteontermination = true }, ] rootblockdevice = [ { volume_size = "50" volume_type = "gp2" }, ] asg_name = "example-asg" vpczoneidentifier = ["subnet-1235678", "subnet-87654321"] healthchecktype = "EC2" min_size = 0 max_size = 1 desired_capacity = 1 waitforcapacity_timeout = 0 tags = [ { key = "Environment" value = "dev" propagateatlaunch = true }, { key = "Project" value = "megasecret" propagateatlaunch = true }, ] } ``` </details>