Project: KICS (Provisioning / Security & Compliance)
File: e9b7acf9-9ba0-4837-a744-31e7df1e434d.md

title: SQS VPC Endpoint Without DNS Resolution hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e9b7acf9-9ba0-4837-a744-31e7df1e434d Query name: SQS VPC Endpoint Without DNS Resolution Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: SQS VPC Endpoint should have DNS resolution enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="95" locals { region = "us-east-1" cidr_block = "172.16.0.0/16" publicsubnetcidr_block = "172.16.100.0/24" quadzerocidr_block = "0.0.0.0/0" } provider "aws" { region = local.region } resource "aws_vpc" "main" { cidrblock = local.cidrblock enablednssupport = false enablednshostnames = false } resource "aws_subnet" "public-subnet" { vpcid = awsvpc.main.id cidrblock = local.publicsubnetcidrblock tags = { Name = "public-subnet" } } resource "awsroutetable" "public-rtb" { vpcid = awsvpc.main.id route { cidrblock = local.cidrblock vpcendpointid = awsvpcendpoint.sqs-vpc-endpoint.id } route { cidr_block = "0.0.0.0/0" gatewayid = awsinternet_gateway.igw.id } tags = { Name = "public-rtb" } } resource "awsroutetable_association" "public-rtb-assoc" { subnetid = awssubnet.public-subnet.id routetableid = awsroutetable.public-rtb.id } resource "awssecuritygroup" "public-internet-sg" { name = "public-internet-sg" description = "Allow all local traffic with internet access" vpcid = awsvpc.main.id egress { from_port = 0 to_port = 0 protocol = "-1" cidrblocks = [local.quadzerocidrblock] } ingress { from_port = 0 to_port = 0 protocol = "-1" cidrblocks = [local.cidrblock] } } data "aws_ami" "ubuntu" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "aws_instance" "test-ec2-instance" { ami = data.aws_ami.ubuntu.id instance_type = "t2.micro" subnetid = awssubnet.public-subnet.id vpcsecuritygroupids = [awssecurity_group.public-internet-sg.id] } resource "awsvpcendpoint" "sqs-vpc-endpoint" { vpcid = awsvpc.main.id service_name = "com.amazonaws.${local.region}.sqs" vpcendpointtype = "Interface" privatednsenabled = true subnetids = [awssubnet.public-subnet.id] securitygroupids = [awssecuritygroup.public-internet-sg.id] } resource "awssqsqueue" "test-queue" { name = "test-queue" } resource "awsinternetgateway" "igw" { vpcid = awsvpc.main.id } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="13" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true enablednssupport = false tags = { Terraform = "true" Environment = "dev" } } ``` ```tf title="Negative test num. 1 - tf file" resource "aws_vpc" "main2" { cidrblock = local.cidrblock enablednssupport = true enablednshostnames = false } resource "awsvpcendpoint" "sqs-vpc-endpoint2" { vpcid = awsvpc.main2.id service_name = "com.amazonaws.${local.region}.sqs" vpcendpointtype = "Interface" privatednsenabled = true subnetids = [awssubnet.public-subnet.id] securitygroupids = [awssecuritygroup.public-internet-sg.id] } ``` ```tf title="Negative test num. 2 - tf file" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true enablednssupport = true tags = { Terraform = "true" Environment = "dev" } } ```