Fix security vulnerabilities across Terraform modules and Docker Compose configs

docker-compose.enhanced.yml

@@ -17,13 +17,13 @@ services:
       - "4566:4566"
     environment:
       - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY}
-      - DEBUG=1
+      - DEBUG=${LOCALSTACK_DEBUG:-0}
       - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts
       - DATA_DIR=/tmp/localstack/data
       - DOCKER_HOST=unix:///var/run/docker.sock
       - AWS_DEFAULT_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=develop-key
-      - AWS_SECRET_ACCESS_KEY=develop-secret
+      - AWS_ACCESS_KEY_ID=${DEVELOP_AWS_ACCESS_KEY_ID:-test}
+      - AWS_SECRET_ACCESS_KEY=${DEVELOP_AWS_SECRET_ACCESS_KEY:-test}
       - PERSISTENCE=1
     volumes:
       - "./localstack/develop:/tmp/localstack"
@@ -45,13 +45,13 @@ services:
       - "4567:4566"
     environment:
       - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY}
-      - DEBUG=1
+      - DEBUG=${LOCALSTACK_DEBUG:-0}
       - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts
       - DATA_DIR=/tmp/localstack/data
       - DOCKER_HOST=unix:///var/run/docker.sock
       - AWS_DEFAULT_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=nonprod-key
-      - AWS_SECRET_ACCESS_KEY=nonprod-secret
+      - AWS_ACCESS_KEY_ID=${NONPROD_AWS_ACCESS_KEY_ID:-test}
+      - AWS_SECRET_ACCESS_KEY=${NONPROD_AWS_SECRET_ACCESS_KEY:-test}
       - PERSISTENCE=1
     volumes:
       - "./localstack/nonprod:/tmp/localstack"
@@ -73,13 +73,13 @@ services:
       - "4568:4566"
     environment:
       - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY}
-      - DEBUG=1
+      - DEBUG=${LOCALSTACK_DEBUG:-0}
       - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts
       - DATA_DIR=/tmp/localstack/data
       - DOCKER_HOST=unix:///var/run/docker.sock
       - AWS_DEFAULT_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=staging-key
-      - AWS_SECRET_ACCESS_KEY=staging-secret
+      - AWS_ACCESS_KEY_ID=${STAGING_AWS_ACCESS_KEY_ID:-test}
+      - AWS_SECRET_ACCESS_KEY=${STAGING_AWS_SECRET_ACCESS_KEY:-test}
       - PERSISTENCE=1
     volumes:
       - "./localstack/staging:/tmp/localstack"
@@ -101,13 +101,13 @@ services:
       - "4569:4566"
     environment:
       - LOCALSTACK_API_KEY=${LOCALSTACK_API_KEY}
-      - DEBUG=1
+      - DEBUG=${LOCALSTACK_DEBUG:-0}
       - SERVICES=s3,dynamodb,lambda,apigateway,iam,kms,ec2,sts
       - DATA_DIR=/tmp/localstack/data
       - DOCKER_HOST=unix:///var/run/docker.sock
       - AWS_DEFAULT_REGION=us-east-1
-      - AWS_ACCESS_KEY_ID=prod-key
-      - AWS_SECRET_ACCESS_KEY=prod-secret
+      - AWS_ACCESS_KEY_ID=${PROD_AWS_ACCESS_KEY_ID:-test}
+      - AWS_SECRET_ACCESS_KEY=${PROD_AWS_SECRET_ACCESS_KEY:-test}
       - PERSISTENCE=1
     volumes:
       - "./localstack/prod:/tmp/localstack"

docker-compose.test.yml

@@ -8,7 +8,7 @@ services:
       - "4566:4566"
     environment:
       - SERVICES=s3,dynamodb,ec2,iam,kms,lambda,apigateway,sts
-      - DEBUG=1
+      - DEBUG=${LOCALSTACK_DEBUG:-0}
       - LOCALSTACK_AUTH_TOKEN=${LOCALSTACK_AUTH_TOKEN}
       - DOCKER_HOST=unix:///var/run/docker.sock
       - HOSTNAME_EXTERNAL=localhost

environments/main.tf

@@ -148,7 +148,7 @@ resource "aws_iam_role_policy" "lambda_policy" {
           "dynamodb:Scan",
           "dynamodb:Query"
         ]
-        Resource = "*"
+        Resource = module.dynamodb_table.table_arn
       },
       {
         Effect = "Allow"
@@ -157,7 +157,7 @@ resource "aws_iam_role_policy" "lambda_policy" {
           "logs:CreateLogStream",
           "logs:PutLogEvents"
         ]
-        Resource = "arn:aws:logs:*:*:*"
+        Resource = "arn:aws:logs:us-east-1:${var.account_id}:log-group:/aws/lambda/${var.lambda_function_name}:*"
       }
     ]
   })

modules/api_gateway/v0.1.0/main.tf

@@ -16,7 +16,7 @@ resource "aws_api_gateway_method" "this" {
   rest_api_id   = aws_api_gateway_rest_api.this.id
   resource_id   = aws_api_gateway_resource.this.id
   http_method   = var.methods[count.index]
-  authorization = "NONE"
+  authorization = var.authorization
 }
 
 resource "aws_api_gateway_integration" "this" {

modules/api_gateway/v0.1.0/variables.tf

@@ -34,4 +34,10 @@ variable "tags" {
   description = "Tags to apply to the API Gateway"
   type        = map(string)
   default     = {}
-} 
+}
+
+variable "authorization" {
+  description = "Authorization type for API Gateway methods (e.g., NONE, AWS_IAM, CUSTOM, COGNITO_USER_POOLS)"
+  type        = string
+  default     = "AWS_IAM"
+}

modules/api_gateway/v0.2.0/main.tf

@@ -16,7 +16,7 @@ resource "aws_api_gateway_method" "this" {
   rest_api_id   = aws_api_gateway_rest_api.this.id
   resource_id   = aws_api_gateway_resource.this.id
   http_method   = var.methods[count.index]
-  authorization = "NONE"
+  authorization = var.authorization
 }
 
 resource "aws_api_gateway_integration" "this" {

modules/api_gateway/v0.2.0/variables.tf

@@ -34,4 +34,10 @@ variable "tags" {
   description = "Tags to apply to the API Gateway"
   type        = map(string)
   default     = {}
-} 
+}
+
+variable "authorization" {
+  description = "Authorization type for API Gateway methods (e.g., NONE, AWS_IAM, CUSTOM, COGNITO_USER_POOLS)"
+  type        = string
+  default     = "AWS_IAM"
+}

modules/dynamodb/v0.1.0/main.tf

@@ -15,6 +15,10 @@ resource "aws_dynamodb_table" "this" {
     }
   }
 
+  point_in_time_recovery {
+    enabled = true
+  }
+
   tags = var.tags
 }
 

modules/dynamodb/v0.2.0/main.tf

@@ -15,6 +15,10 @@ resource "aws_dynamodb_table" "this" {
     }
   }
 
+  point_in_time_recovery {
+    enabled = true
+  }
+
   tags = var.tags
 }
 

modules/vpc/v0.1.0/main.tf

@@ -25,7 +25,7 @@ resource "aws_subnet" "public" {
   cidr_block        = cidrsubnet(var.cidr_block, 8, count.index)
   availability_zone = var.availability_zones[count.index]
 
-  map_public_ip_on_launch = true
+  map_public_ip_on_launch = false
 
   tags = merge(var.tags, {
     Name = "${var.name}-public-${count.index + 1}"
@@ -71,7 +71,7 @@ resource "aws_security_group" "default" {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = [var.cidr_block]
   }
 
   egress {

modules/vpc/v0.2.0/main.tf

@@ -25,7 +25,7 @@ resource "aws_subnet" "public" {
   cidr_block        = cidrsubnet(var.cidr_block, 8, count.index)
   availability_zone = var.availability_zones[count.index]
 
-  map_public_ip_on_launch = true
+  map_public_ip_on_launch = false
 
   tags = merge(var.tags, {
     Name = "${var.name}-public-${count.index + 1}"
@@ -71,7 +71,7 @@ resource "aws_security_group" "default" {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = [var.cidr_block]
   }
 
   egress {