Project: KICS (Provisioning / Security & Compliance)
File: 9ecb6b21-18bc-4aa7-bd07-db20f1c746db.md

title: CloudFormation Specifying Credentials Not Safe hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9ecb6b21-18bc-4aa7-bd07-db20f1c746db Query name: CloudFormation Specifying Credentials Not Safe Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Specifying credentials in the template itself is probably not safe to do.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="33 35 71" AWSTemplateFormatVersion: 2010-09-09 Resources: WebServer: Type: AWS::EC2::Instance DependsOn: "BucketPolicy" Metadata: AWS::CloudFormation::Init: config: packages: yum: httpd: [] files: /var/www/html/index.html: source: Fn::Join: "" - "http://s3.amazonaws.com/" Ref: "BucketName" "/index.html" mode: "000400" owner: "apache" group: "apache" authentication: "S3AccessCreds" services: sysvinit: httpd: enabled: "true" ensureRunning: "true" AWS::CloudFormation::Authentication: S3AccessCreds: type: "S3" accessKeyId: Ref: "CfnKeys" secretKey: Fn::GetAtt: "CfnKeys" "SecretAccessKey" WebServer2: Type: AWS::EC2::Instance DependsOn: "BucketPolicy" Metadata: AWS::CloudFormation::Init: config: packages: yum: httpd: [] files: /var/www/html/index.html: source: Fn::Join: "" - "http://s3.amazonaws.com/" Ref: "BucketName" "/index.html" mode: "000400" owner: "apache" group: "apache" authentication: "S3AccessCreds" services: sysvinit: httpd: enabled: "true" ensureRunning: "true" AWS::CloudFormation::Authentication: BasicAccessCreds: type: "basic" username: Ref: "UserName" password: Ref: "Password" uris: "example.com/test" Properties: EC2 Resource Properties ... ``` ```json title="Positive test num. 2 - json file" hl_lines="48 51 112" { "Properties": "EC2 Resource Properties ...", "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "WebServer": { "DependsOn": "BucketPolicy", "Metadata": { "AWS::CloudFormation::Init": { "config": { "packages": { "yum": { "httpd": [] } }, "files": { "/var/www/html/index.html": { "authentication": "S3AccessCreds", "source": { "Fn::Join": [ "", [ "http://s3.amazonaws.com/", { "Ref": "BucketName" }, "/index.html" ] ] }, "mode": "000400", "owner": "apache", "group": "apache" } }, "services": { "sysvinit": { "httpd": { "enabled": "true", "ensureRunning": "true" } } } } }, "AWS::CloudFormation::Authentication": { "S3AccessCreds": { "type": "S3", "accessKeyId": { "Ref": "CfnKeys" }, "secretKey": { "Fn::GetAtt": [ "CfnKeys", "SecretAccessKey" ] } } } }, "Type": "AWS::EC2::Instance" }, "WebServer2": { "Type": "AWS::EC2::Instance", "DependsOn": "BucketPolicy", "Metadata": { "AWS::CloudFormation::Init": { "config": { "packages": { "yum": { "httpd": [] } }, "files": { "/var/www/html/index.html": { "group": "apache", "authentication": "S3AccessCreds", "source": { "Fn::Join": [ "", [ "http://s3.amazonaws.com/", { "Ref": "BucketName" }, "/index.html" ] ] }, "mode": "000400", "owner": "apache" } }, "services": { "sysvinit": { "httpd": { "enabled": "true", "ensureRunning": "true" } } } } }, "AWS::CloudFormation::Authentication": { "BasicAccessCreds": { "uris": [ "example.com/test" ], "type": "basic", "username": { "Ref": "UserName" }, "password": { "Ref": "Password" } } } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: WebServer: Type: AWS::EC2::Instance Metadata: AWS::CloudFormation::Init: config: packages: yum: httpd: [] files: /var/www/html/index.html: source: Fn::Join: "" - "http://s3.amazonaws.com/" Ref: "BucketName" "/index.html" mode: "000400" owner: "apache" group: "apache" authentication: "S3AccessCreds" services: sysvinit: httpd: enabled: "true" ensureRunning: "true" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "WebServer": { "Type": "AWS::EC2::Instance", "DependsOn": "BucketPolicy", "Metadata": { "AWS::CloudFormation::Init": { "config": { "packages": { "yum": { "httpd": [] } }, "files": { "/var/www/html/index.html": { "source": { "Fn::Join": [ "", [ "http://s3.amazonaws.com/", { "Ref": "BucketName" }, "/index.html" ] ] }, "mode": "000400", "owner": "apache", "group": "apache", "authentication": "S3AccessCreds" } }, "services": { "sysvinit": { "httpd": { "enabled": "true", "ensureRunning": "true" } } } } } } } }, "Properties": "EC2 Resource Properties ...", "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ```