{"id":13820058,"url":"https://github.com/mitre/cis-aws-foundations-hardening","last_synced_at":"2025-07-06T19:03:55.246Z","repository":{"id":44578834,"uuid":"115545037","full_name":"mitre/cis-aws-foundations-hardening","owner":"mitre","description":"(WIP) A terraform / kitchen-terraform hardening baseline for the cis-aws-foundations-baseline","archived":false,"fork":false,"pushed_at":"2022-02-07T08:40:37.000Z","size":171,"stargazers_count":24,"open_issues_count":3,"forks_count":13,"subscribers_count":25,"default_branch":"master","last_synced_at":"2025-04-21T16:40:56.975Z","etag":null,"topics":["aws","aws-hardening","aws-security","cis","cis-aws-benchmark","inspec","kitchen-terraform","mitre-corporation","mitre-inspec","test-kitchen","wip"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mitre.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-12-27T17:55:15.000Z","updated_at":"2024-07-04T05:33:21.000Z","dependencies_parsed_at":"2022-08-20T15:11:07.255Z","dependency_job_id":null,"html_url":"https://github.com/mitre/cis-aws-foundations-hardening","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mitre/cis-aws-foundations-hardening","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fcis-aws-foundations-hardening","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fcis-aws-foundations-hardening/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fcis-aws-foundations-hardening/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fcis-aws-foundations-hardening/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mitre","download_url":"https://codeload.github.com/mitre/cis-aws-foundations-hardening/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fcis-aws-foundations-hardening/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263957685,"owners_count":23535603,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-hardening","aws-security","cis","cis-aws-benchmark","inspec","kitchen-terraform","mitre-corporation","mitre-inspec","test-kitchen","wip"],"created_at":"2024-08-04T08:00:57.873Z","updated_at":"2025-07-06T19:03:55.183Z","avatar_url":"https://github.com/mitre.png","language":"HCL","funding_links":[],"categories":["HCL"],"sub_categories":[],"readme":"# cis-aws-foundations-hardening - v1.1.0\n\nA terraform / kitchen-terraform hardening baseline the CIS AWS Foundations Benchmark v1.1.0.\n\n## Overview\n\nThis will help you setup and validate an AWS Environment as per CIS AWS Benchmark. This build will not modify existing resources.\nIt will modify default `default vpc` and each `default security group` as per CIS guidance.\n\n## Versioning and State of Development\nThis project uses the [Semantic Versioning Policy](https://semver.org/). \n\n### Branches\nThe master branch contains the latest version of the software leading up to a new release. \n\nOther branches contain feature-specific updates. \n\n### Tags\nTags indicate official releases of the project.\n\nPlease note 0.x releases are works in progress (WIP) and may change at any time.   \n\n### Tech Used\n- kitchen-terraform (\u003e=v3.0.0)\n- test-kitchen (v.1.60.0)\n- inspec.io\n- terraform ( \u003e v0.10.2)\n- tfenv\n- awscli (v1.1)\n\n## Pre-Checks\n\nA. Use `tfenv` to switch to your `tf v0.11.0` environment  \nB. Install any needed gems via `bundle install`  \nC. Use the `pre-kitchen.rb` script to ensure you have all the env_vars setup as needed.  \n```\nruby pre-kitchen.rb\n```\n\n## Usage\n\n### Setup your Environment  \n\nPlease see TESTING_AGAINST_AWS.md for details on how to setup the needed AWS accounts to perform testing.\n\nFollow these instructions carefully.\n\n1. Create an AWS account.  Make a note of the account email and root password in a secure secret storage system.\n2. Create an IAM user named `test-fixture-maker`.\n  * Enable programmatic access (to generate an access key)\n  * Note the access key and secret key ID that are generated.\n3. Create an IAM Group named `test-fixture-maker-group`.\n  * Direct-attach the policy AdministratorAccess\n  * Add user `test-fixture-maker` to the group\n\n4. Set the required env variables.\n\n- AWS Credentials\n```\nAWS_ACCESS_KEY_ID         - The AWS Access Key that is to be used (default: none)\nAWS_SECRET_ACCESS_KEY     - The AWS Secret Access Key that is to be used (default: none)\n```\n- TF_VAR_ prevents credentials from being populated on terrafrom logs\n```\nTF_VAR_aws_ssh_key_id     - The value is the name of the AWS key pair you want to use (default: none) (hide from logs)\nTF_VAR_aws_access_key     - The AWS Access Key that is to be used (default: none) (hide from logs)\nTF_VAR_aws_secret_key     - The AWS Secret Access Key that is to be used (default: none) (hide from logs)\n```\n- Infrastructure Data\n```\nAWS_DEFAULT_REGION        - The AWS Region you would like to use (default: us-east-1)\nAWS_DEFAULT_INSTANCE_TYPE - The EC2 instance type (also known as size) to use. (default: none)\nSSH_SG_CIDR               - Specify an IP address in CIDR notation, a CIDR block for ssh ingress rule. (default: none)\n```\n\n### Build/Verify\n\nRun Test kitchen\n\n  a. `bundle exec kitchen list`  \n  b. `bundle exec kitchen create cis-setup`  \n  c. `bundle exec kitchen converge cis-setup`  \n  d. `bundle exec kitchen verify cis-setup`  \n  e. `bundle exec kitchen destroy cis-setup`  \n\n\n### Known Issues\n\n1) AWS Simple Queue Service takes a few minutes to build, so please wait a few minutes before running `kitchen verify`.\n\n2) Known Terrafrom bug that affects Managed policy attachment shows up on a second `kitchen converge` or `kitchen destroy`. \nhttps://github.com/hashicorp/terraform/issues/5979 .\nPlease converge or destroy again to get past the error.\n\n## Questions\n\n- see: https://newcontext-oss.github.io/kitchen-terraform/tutorials/amazon_provider_ec2.html\n- see: https://github.com/chef/inspec-aws\n\n## Developing\n\nWe use a feature-branch model for development. Plese create a fork and push a PR as a feature-branch.\n\n## NOTICE \n\n© 2018 The MITRE Corporation.  \n\nApproved for Public Release; Distribution Unlimited. Case Number 18-3678.    \n\n## NOTICE\nMITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.\n\n## NOTICE  \n\nThis software was produced for the U. S. Government under Contract Number HHSM-500-2012-00008I, and is subject to Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.   \n\nNo other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.   \n\nFor further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA  22102-7539, (703) 983-6000.  \n\n## NOTICE\n\nCIS Benchmarks are published by the Center for Internet Security (CIS), see: https://www.cisecurity.org/.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Fcis-aws-foundations-hardening","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmitre%2Fcis-aws-foundations-hardening","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Fcis-aws-foundations-hardening/lists"}