From 81c2b4b78698b236bed5e13c04464b66901399dc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 22 Mar 2026 02:56:45 +0000 Subject: [PATCH 1/2] Initial plan From 28da25e5aa06eb546ec3f6a771500f00fe95ac2c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 22 Mar 2026 03:02:44 +0000 Subject: [PATCH 2/2] Fix security vulnerabilities: VPC groups, API auth, IAM scoping, hardcoded creds, debug mode, PITR Co-authored-by: enturesting <123045031+enturesting@users.noreply.github.com> Agent-Logs-Url: https://github.com/enturesting/cloudsimulation_localstack/sessions/5edf1808-f385-4742-b793-6476648013a4 --- docker-compose.enhanced.yml | 24 ++++++++++++------------ docker-compose.test.yml | 2 +- environments/main.tf | 4 ++-- modules/api_gateway/v0.1.0/main.tf | 2 +- modules/api_gateway/v0.1.0/variables.tf | 8 +++++++- modules/api_gateway/v0.2.0/main.tf | 2 +- modules/api_gateway/v0.2.0/variables.tf | 8 +++++++- modules/dynamodb/v0.1.0/main.tf | 4 ++++ modules/dynamodb/v0.2.0/main.tf | 4 ++++ modules/vpc/v0.1.0/main.tf | 4 ++-- modules/vpc/v0.2.0/main.tf | 4 ++-- 11 files changed, 43 insertions(+), 23 deletions(-) diff --git a/docker-compose.enhanced.yml b/docker-compose.enhanced.yml index 1e4a4ab..28d35a1 100644 --- a/docker-compose.enhanced.yml +++ b/docker-compose.enhanced.yml @@ -17,13 +17,13 @@ services: - "4566:4566" environment: - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY} - - DEBUG=1 + - DEBUG=${LOCALSTACK_DEBUG:-0} - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts - DATA_DIR=/tmp/localstack/data - DOCKER_HOST=unix:///var/run/docker.sock - AWS_DEFAULT_REGION=us-east-1 - - AWS_ACCESS_KEY_ID=develop-key - - AWS_SECRET_ACCESS_KEY=develop-secret + - AWS_ACCESS_KEY_ID=${DEVELOP_AWS_ACCESS_KEY_ID:-test} + - AWS_SECRET_ACCESS_KEY=${DEVELOP_AWS_SECRET_ACCESS_KEY:-test} - PERSISTENCE=1 volumes: - "./localstack/develop:/tmp/localstack" @@ -45,13 +45,13 @@ services: - "4567:4566" environment: - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY} - - DEBUG=1 + - DEBUG=${LOCALSTACK_DEBUG:-0} - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts - DATA_DIR=/tmp/localstack/data - DOCKER_HOST=unix:///var/run/docker.sock - AWS_DEFAULT_REGION=us-east-1 - - AWS_ACCESS_KEY_ID=nonprod-key - - AWS_SECRET_ACCESS_KEY=nonprod-secret + - AWS_ACCESS_KEY_ID=${NONPROD_AWS_ACCESS_KEY_ID:-test} + - AWS_SECRET_ACCESS_KEY=${NONPROD_AWS_SECRET_ACCESS_KEY:-test} - PERSISTENCE=1 volumes: - "./localstack/nonprod:/tmp/localstack" @@ -73,13 +73,13 @@ services: - "4568:4566" environment: - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY} - - DEBUG=1 + - DEBUG=${LOCALSTACK_DEBUG:-0} - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts - DATA_DIR=/tmp/localstack/data - DOCKER_HOST=unix:///var/run/docker.sock - AWS_DEFAULT_REGION=us-east-1 - - AWS_ACCESS_KEY_ID=staging-key - - AWS_SECRET_ACCESS_KEY=staging-secret + - AWS_ACCESS_KEY_ID=${STAGING_AWS_ACCESS_KEY_ID:-test} + - AWS_SECRET_ACCESS_KEY=${STAGING_AWS_SECRET_ACCESS_KEY:-test} - PERSISTENCE=1 volumes: - "./localstack/staging:/tmp/localstack" @@ -101,13 +101,13 @@ services: - "4569:4566" environment: - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY} - - DEBUG=1 + - DEBUG=${LOCALSTACK_DEBUG:-0} - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts - DATA_DIR=/tmp/localstack/data - DOCKER_HOST=unix:///var/run/docker.sock - AWS_DEFAULT_REGION=us-east-1 - - AWS_ACCESS_KEY_ID=prod-key - - AWS_SECRET_ACCESS_KEY=prod-secret + - AWS_ACCESS_KEY_ID=${PROD_AWS_ACCESS_KEY_ID:-test} + - AWS_SECRET_ACCESS_KEY=${PROD_AWS_SECRET_ACCESS_KEY:-test} - PERSISTENCE=1 volumes: - "./localstack/prod:/tmp/localstack" diff --git a/docker-compose.test.yml b/docker-compose.test.yml index 06c8205..775d291 100644 --- a/docker-compose.test.yml +++ b/docker-compose.test.yml @@ -8,7 +8,7 @@ services: - "4566:4566" environment: - SERVICES=s3,dynamodb,ec2,iam,kms,lambda,apigateway,sts - - DEBUG=1 + - DEBUG=${LOCALSTACK_DEBUG:-0} - LOCALSTACK_AUTH_TOKEN=${LOCALSTACK_AUTH_TOKEN} - DOCKER_HOST=unix:///var/run/docker.sock - HOSTNAME_EXTERNAL=localhost diff --git a/environments/main.tf b/environments/main.tf index 336abb4..66322b0 100644 --- a/environments/main.tf +++ b/environments/main.tf @@ -148,7 +148,7 @@ resource "aws_iam_role_policy" "lambda_policy" { "dynamodb:Scan", "dynamodb:Query" ] - Resource = "*" + Resource = module.dynamodb_table.table_arn }, { Effect = "Allow" @@ -157,7 +157,7 @@ resource "aws_iam_role_policy" "lambda_policy" { "logs:CreateLogStream", "logs:PutLogEvents" ] - Resource = "arn:aws:logs:*:*:*" + Resource = "arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/lambda/${var.lambda_function_name}:*" } ] }) diff --git a/modules/api_gateway/v0.1.0/main.tf b/modules/api_gateway/v0.1.0/main.tf index 4b4b837..80681a5 100644 --- a/modules/api_gateway/v0.1.0/main.tf +++ b/modules/api_gateway/v0.1.0/main.tf @@ -16,7 +16,7 @@ resource "aws_api_gateway_method" "this" { rest_api_id = aws_api_gateway_rest_api.this.id resource_id = aws_api_gateway_resource.this.id http_method = var.methods[count.index] - authorization = "NONE" + authorization = var.authorization } resource "aws_api_gateway_integration" "this" { diff --git a/modules/api_gateway/v0.1.0/variables.tf b/modules/api_gateway/v0.1.0/variables.tf index 5e533a6..02a8332 100644 --- a/modules/api_gateway/v0.1.0/variables.tf +++ b/modules/api_gateway/v0.1.0/variables.tf @@ -34,4 +34,10 @@ variable "tags" { description = "Tags to apply to the API Gateway" type = map(string) default = {} -} \ No newline at end of file +} + +variable "authorization" { + description = "Authorization type for API Gateway methods (e.g., NONE, AWS_IAM, CUSTOM, COGNITO_USER_POOLS)" + type = string + default = "AWS_IAM" +} \ No newline at end of file diff --git a/modules/api_gateway/v0.2.0/main.tf b/modules/api_gateway/v0.2.0/main.tf index c37bcbe..15fe728 100644 --- a/modules/api_gateway/v0.2.0/main.tf +++ b/modules/api_gateway/v0.2.0/main.tf @@ -16,7 +16,7 @@ resource "aws_api_gateway_method" "this" { rest_api_id = aws_api_gateway_rest_api.this.id resource_id = aws_api_gateway_resource.this.id http_method = var.methods[count.index] - authorization = "NONE" + authorization = var.authorization } resource "aws_api_gateway_integration" "this" { diff --git a/modules/api_gateway/v0.2.0/variables.tf b/modules/api_gateway/v0.2.0/variables.tf index 5e533a6..02a8332 100644 --- a/modules/api_gateway/v0.2.0/variables.tf +++ b/modules/api_gateway/v0.2.0/variables.tf @@ -34,4 +34,10 @@ variable "tags" { description = "Tags to apply to the API Gateway" type = map(string) default = {} -} \ No newline at end of file +} + +variable "authorization" { + description = "Authorization type for API Gateway methods (e.g., NONE, AWS_IAM, CUSTOM, COGNITO_USER_POOLS)" + type = string + default = "AWS_IAM" +} \ No newline at end of file diff --git a/modules/dynamodb/v0.1.0/main.tf b/modules/dynamodb/v0.1.0/main.tf index 1fcba67..a9bc4fd 100644 --- a/modules/dynamodb/v0.1.0/main.tf +++ b/modules/dynamodb/v0.1.0/main.tf @@ -15,6 +15,10 @@ resource "aws_dynamodb_table" "this" { } } + point_in_time_recovery { + enabled = true + } + tags = var.tags } diff --git a/modules/dynamodb/v0.2.0/main.tf b/modules/dynamodb/v0.2.0/main.tf index 1fcba67..a9bc4fd 100644 --- a/modules/dynamodb/v0.2.0/main.tf +++ b/modules/dynamodb/v0.2.0/main.tf @@ -15,6 +15,10 @@ resource "aws_dynamodb_table" "this" { } } + point_in_time_recovery { + enabled = true + } + tags = var.tags } diff --git a/modules/vpc/v0.1.0/main.tf b/modules/vpc/v0.1.0/main.tf index f33f60e..ce7c935 100644 --- a/modules/vpc/v0.1.0/main.tf +++ b/modules/vpc/v0.1.0/main.tf @@ -25,7 +25,7 @@ resource "aws_subnet" "public" { cidr_block = cidrsubnet(var.cidr_block, 8, count.index) availability_zone = var.availability_zones[count.index] - map_public_ip_on_launch = true + map_public_ip_on_launch = false tags = merge(var.tags, { Name = "${var.name}-public-${count.index + 1}" @@ -71,7 +71,7 @@ resource "aws_security_group" "default" { from_port = 0 to_port = 0 protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = [var.cidr_block] } egress { diff --git a/modules/vpc/v0.2.0/main.tf b/modules/vpc/v0.2.0/main.tf index f33f60e..ce7c935 100644 --- a/modules/vpc/v0.2.0/main.tf +++ b/modules/vpc/v0.2.0/main.tf @@ -25,7 +25,7 @@ resource "aws_subnet" "public" { cidr_block = cidrsubnet(var.cidr_block, 8, count.index) availability_zone = var.availability_zones[count.index] - map_public_ip_on_launch = true + map_public_ip_on_launch = false tags = merge(var.tags, { Name = "${var.name}-public-${count.index + 1}" @@ -71,7 +71,7 @@ resource "aws_security_group" "default" { from_port = 0 to_port = 0 protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = [var.cidr_block] } egress {