Project: KICS (Provisioning / Security & Compliance)
File: c53c7a89-f9d7-4c7b-8b66-8a555be99593.md

title: Public and Private EC2 Share Role hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c53c7a89-f9d7-4c7b-8b66-8a555be99593 Query name: Public and Private EC2 Share Role Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Public and private EC2 istances should not share the same role.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="103" provider "aws" { region = "us-east-1" } locals { test_description = "two EC2s, one public, one private" test_name = "Ec2RoleShareRule test - use case 1" } module "vpc" { source = "terraform-aws-modules/vpc/aws" name = "Ec2RoleShareRule1" azs = ["us-east-1a", "us-east-1b", "us-east-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true cidr = "10.0.0.0/16" managedefaultsecurity_group= true defaultsecuritygroup_ingress = [ { from_port = 22 to_port = 22 protocol = "tcp" description = "ssh" cidr_blocks = "0.0.0.0/0" }] defaultsecuritygroup_egress =[] version = "3.7.0" } data "aws_ami" "ubuntu" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "awsiamrole" "test_role" { name = "test_role" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awsiaminstanceprofile" "testprofile" { name = "test_profile" role = "awsiamrole.test_role.name" } resource "awsiamrolepolicy" "testpolicy" { name = "test_policy" role = "awsiamrole.test_role.id" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsinstance" "pubins" { ami = "data.aws_ami.ubuntu.id" instance_type = "t2.micro" subnetid = module.vpc.publicsubnets[0] iaminstanceprofile = awsiaminstanceprofile.testprofile.name } resource "awsinstance" "privins" { ami = "data.aws_ami.ubuntu.id" instance_type = "t2.micro" subnetid = module.vpc.privatesubnets[0] iaminstanceprofile = awsiaminstanceprofile.testprofile.name } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="38" module "vpc" { source = "terraform-aws-modules/vpc/aws" name = "Ec2RoleShareRule1" azs = ["us-east-1a", "us-east-1b", "us-east-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true cidr = "10.0.0.0/16" managedefaultsecurity_group = true defaultsecuritygroup_ingress = [ { from_port = 22 to_port = 22 protocol = "tcp" description = "ssh" cidr_blocks = "0.0.0.0/0" }] defaultsecuritygroup_egress = [] version = "3.7.0" } module "ec2publicinstance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnetid = module.vpc.publicsubnets[0] iaminstanceprofile = awsiaminstanceprofile.testprofile1.name tags = { Terraform = "true" Environment = "dev" } } module "ec2privateinstance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnetid =

iaminstanceprofile = awsiaminstanceprofile.testprofile1.name tags = { Terraform = "true" Environment = "dev" } } resource "awsiaminstanceprofile" "testprofile1" { name = "test_profile" role = "awsiamrole.test_role1.name" } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } locals { test_description = "two EC2s, one public, one private" test_name = "Ec2RoleShareRule test - use case 1" } module "vpc" { source = "terraform-aws-modules/vpc/aws" name = "Ec2RoleShareRule1" azs = ["us-east-1a", "us-east-1b", "us-east-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true cidr = "10.0.0.0/16" managedefaultsecurity_group= true defaultsecuritygroup_ingress = [ { from_port = 22 to_port = 22 protocol = "tcp" description = "ssh" cidr_blocks = "0.0.0.0/0" }] defaultsecuritygroup_egress =[] version = "3.7.0" } data "aws_ami" "ubuntu" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "awsiamrole" "test_role2" { name = "test_role2" assumerolepolicy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" }, "Effect": "Allow", "Sid": "" } ] } EOF } resource "awsiaminstanceprofile" "testprofile2" { name = "test_profile" role = "awsiamrole.test_role2.name" } resource "awsiamrolepolicy" "testpolicy2" { name = "test_policy" role = "awsiamrole.test_role2.id" policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:*" ], "Effect": "Allow", "Resource": "*" } ] } EOF } resource "awsinstance" "pubins2" { ami = "data.aws_ami.ubuntu.id" instance_type = "t2.micro" subnetid = module.vpc.publicsubnets[0] iaminstanceprofile = awsiaminstanceprofile.testprofile2.name } resource "awsinstance" "privins2" { ami = "data.aws_ami.ubuntu.id" instance_type = "t2.micro" subnetid = module.vpc.privatesubnets[0] iaminstanceprofile = awsiaminstanceprofile.testprofile3.name } ``` ```tf title="Negative test num. 2 - tf file" module "vpc" { source = "terraform-aws-modules/vpc/aws" name = "Ec2RoleShareRule1" azs = ["us-east-1a", "us-east-1b", "us-east-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true cidr = "10.0.0.0/16" managedefaultsecurity_group = true defaultsecuritygroup_ingress = [ { from_port = 22 to_port = 22 protocol = "tcp" description = "ssh" cidr_blocks = "0.0.0.0/0" }] defaultsecuritygroup_egress = [] version = "3.7.0" } module "ec2publicinstance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnetid = module.vpc.publicsubnets[0] iaminstanceprofile = awsiaminstanceprofile.testprofile5.name tags = { Terraform = "true" Environment = "dev" } } module "ec2privateinstance" { source = "terraform-aws-modules/ec2-instance/aws" version = "~> 3.0" name = "single-instance" ami = "ami-ebd02392" instance_type = "t2.micro" key_name = "user1" monitoring = true vpcsecuritygroup_ids = ["sg-12345678"] subnetid = module.vpc.privatesubnets[0] iaminstanceprofile = awsiaminstanceprofile.testprofile4.name tags = { Terraform = "true" Environment = "dev" } } resource "awsiaminstanceprofile" "testprofile4" { name = "test_profile" role = "awsiamrole.test_role4.name" } resource "awsiaminstanceprofile" "testprofile5" { name = "test_profile" role = "awsiamrole.test_role5.name" } ```