{"id":15156361,"url":"https://github.com/gruntwork-io/tflint-ruleset-aws-cis","last_synced_at":"2025-10-24T13:30:44.751Z","repository":{"id":91109274,"uuid":"585623041","full_name":"gruntwork-io/tflint-ruleset-aws-cis","owner":"gruntwork-io","description":"Tflint rules for CIS AWS Foundations Benchmark compliance checks. These rules work in addition to the recommendations from Gruntwork's CIS Service Catalog.","archived":false,"fork":false,"pushed_at":"2023-02-18T03:33:38.000Z","size":57,"stargazers_count":11,"open_issues_count":2,"forks_count":5,"subscribers_count":13,"default_branch":"main","last_synced_at":"2024-09-27T19:20:58.489Z","etag":null,"topics":["aws","cis","devops","terraform","tflint"],"latest_commit_sha":null,"homepage":"https://gruntwork.io/achieve-compliance/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gruntwork-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-01-05T16:37:20.000Z","updated_at":"2024-07-14T02:13:21.000Z","dependencies_parsed_at":"2023-03-10T10:15:40.237Z","dependency_job_id":null,"html_url":"https://github.com/gruntwork-io/tflint-ruleset-aws-cis","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gruntwork-io%2Ftflint-ruleset-aws-cis","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gruntwork-io%2Ftflint-ruleset-aws-cis/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gruntwork-io%2Ftflint-ruleset-aws-cis/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gruntwork-io%2Ftflint-ruleset-aws-cis/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gruntwork-io","download_url":"https://codeload.github.com/gruntwork-io/tflint-ruleset-aws-cis/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219868598,"owners_count":16555871,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cis","devops","terraform","tflint"],"created_at":"2024-09-26T19:20:33.370Z","updated_at":"2025-10-24T13:30:44.419Z","avatar_url":"https://github.com/gruntwork-io.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TFLint Ruleset CIS AWS Foundations Benchmark\n\n![CIS AWS Foundations Benchmark Version](https://img.shields.io/badge/CIS%20benchmark%20version-1.5.0-green)\n![https://gruntwork.io/?ref=repo_cis_compliance_aws\"](https://img.shields.io/badge/maintained%20by-gruntwork.io-%235849a6.svg)\n\nTflint rules for CIS AWS Foundations Benchmark compliance checks. These rules work in addition to the recommendations from [Gruntwork's CIS Service Catalog](https://github.com/gruntwork-io/terraform-aws-cis-service-catalog).\n\n\u003e :warning: **This repository is a WIP. It only contains one single rule so far, to validate Security Groups, that is hard to enforce in any other way ([see Rules section](#rules)). In the future, we may add other CIS AWS Foundations Benchmark rules.**\n\n\n## Requirements\n\n- TFLint v0.40+\n- Go v1.19\n\n## Installation\n\nYou can install the plugin with `tflint --init`. Declare a config in `.tflint.hcl` as follows:\n\n```hcl\nplugin \"aws-cis\" {\n  enabled = true\n\n  version = \"\u003cVERSION\u003e\"\n  source  = \"github.com/gruntwork-io/tflint-ruleset-aws-cis\"\n}\n```\n\n## Rules\n\n| Name                                       | Description                                                                        |Severity|Enabled| CIS Recommendation |\n|--------------------------------------------|------------------------------------------------------------------------------------| --- | --- |--------------------|\n| aws_security_group_rule_invalid_cidr_block | Ensure that SG rules do not allow public access to remote administration ports     |ERROR|✔| 5.2 and 5.3        |\n\n## Terragrunt\n\nAn effective way to enforce these rules is to add them to your Terragrunt configuration using [Before Hooks](https://terragrunt.gruntwork.io/docs/features/hooks/#tflint-hook).\n\n```hcl\nterraform {\n  before_hook \"before_hook\" {\n    commands     = [\"apply\", \"plan\"]\n    execute      = [\"tflint\"]\n  }\n}\n```\n\nIn the root of the Terragrunt project, add a `.tflint.hcl` file, replacing `\u003cVERSION\u003e` below with the latest version from the [releases page](https://github.com/gruntwork-io/tflint-ruleset-aws-cis/releases):\n\n```hcl\nplugin \"aws\" {\n    enabled = true\n    version = \"\u003cVERSION\u003e\"\n    source  = \"github.com/gruntwork-io/tflint-ruleset-aws-cis\"\n}\n```\n\n\n## Running locally\n\n### Building the plugin\n\nClone the repository locally and run the following command:\n\n```\n$ make\n```\n\nYou can easily install the built plugin with the following:\n\n```\n$ make install\n```\n\nYou can run the built plugin like the following:\n\n```bash\n$ cat \u003c\u003c EOS \u003e .tflint.hcl\nplugin \"aws-cis\" {\n  enabled = true\n}\nEOS\n$ tflint\n```\n\n### Manual release\n\n**NOTE:** This project doesn't have automated releases at the moment (due to limitations of our GitHub org with GitHub actions) and does not sign the binaries (as `tflint` doesn't currently check signatures for plugins). [See this Slack thread for more info](https://gruntwork-io.slack.com/archives/C046S2PDWP8/p1672915001156189).  \n\nIn order to release the binaries, this project uses [goreleaser](https://goreleaser.com/) ([install instructions](https://goreleaser.com/install/)).\n\nExport the variable `GITHUB_TOKEN` so the binaries can be uploaded to GitHub. The release should run locally from the tag that will have the release.\n\n```\ngit checkout \u003cTAG FOR THE RELEASE, e.g. v0.40.0\u003e\n\nexport GITHUB_TOKEN=\u003cTOKEN\u003e\n\ngoreleaser release\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgruntwork-io%2Ftflint-ruleset-aws-cis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgruntwork-io%2Ftflint-ruleset-aws-cis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgruntwork-io%2Ftflint-ruleset-aws-cis/lists"}