{"id":28426847,"url":"https://github.com/tenable/cnappgoat-scenarios","last_synced_at":"2025-06-25T01:31:52.849Z","repository":{"id":185434607,"uuid":"673295441","full_name":"tenable/cnappgoat-scenarios","owner":"tenable","description":"This repository provides a comprehensive collection of Pulumi scenarios utilized by cnappgoat","archived":false,"fork":false,"pushed_at":"2025-01-28T17:36:20.000Z","size":484,"stargazers_count":21,"open_issues_count":6,"forks_count":15,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-06-05T11:40:45.469Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tenable.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-01T10:03:22.000Z","updated_at":"2025-04-26T03:40:15.000Z","dependencies_parsed_at":"2024-01-08T19:05:21.216Z","dependency_job_id":"67daf63e-8823-4797-b126-07041d8385cb","html_url":"https://github.com/tenable/cnappgoat-scenarios","commit_stats":null,"previous_names":["ermetic-research/cnappgoat-scenarios","tenable/cnappgoat-scenarios"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tenable/cnappgoat-scenarios","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tenable%2Fcnappgoat-scenarios","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tenable%2Fcnappgoat-scenarios/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tenable%2Fcnappgoat-scenarios/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tenable%2Fcnappgoat-scenarios/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tenable","download_url":"https://codeload.github.com/tenable/cnappgoat-scenarios/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tenable%2Fcnappgoat-scenarios/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261785227,"owners_count":23209264,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-05T11:30:50.345Z","updated_at":"2025-06-25T01:31:52.836Z","avatar_url":"https://github.com/tenable.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CNAPPgoat Scenarios Repository\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"https://github.com/ermetic-research/cnappgoat/blob/main/images/logo.png?raw=true\" width=\"40%\" alt=\"CNAPPGoat logo: a smiling goat with a purple cloud background\"\u003e\n\u003c/div\u003e\n\nThis repository provides a comprehensive collection of Pulumi scenarios utilized\nby [CNAPPgoat](https://github.com/ermetic-research/cnappgoat), a multi-cloud, vulnerable-by-design environment\ndeployment tool – specifically engineered to facilitate practice arenas for defenders and pentesters.\n\n## Scenario Structure\n\nEach scenario in this repository is structured with a `Pulumi.yaml` file and a `main.go` file,\n`go.mod` and `go.sum` files should also be included in the scenario.\n\n### The Project File: `Pulumi.yaml\n\nThe `Pulumi.yaml` file is a project file in Pulumi and it specifies the runtime, the name of the project,\nits description and all parameters used by CNAPPgoat.\n\nHere is an example of a `Pulumi.yaml` file:\n\n```yaml\nname: ciem-aws-iam-external-id-3rd-party-role\nruntime: go\ndescription: The scenario creates an IAM role without an external ID parameter.\n  This exposes your account to confused deputy attacks.\n  To fix, include the condition \"sts:ExternalId\" in your\n  IAM role trust policy during the creation process.\ncnappgoat-params:\n  description: The scenario involves the creation of an IAM role for a 3rd party without\n    an external ID parameter. This flaw escalates the risk of impersonation attacks,\n    especially 'confused deputy' scenarios, where rogue actors might access your account\n    using the same vendor's services. To mitigate this issue, it's essential to include\n    an 'External ID' in the trust policy of the IAM role, thereby adding an extra\n    layer of security against potential impersonators.\n  friendlyName: IAM Role Without External ID\n  id: ciem-aws-iam-external-id-3rd-party-role\n  module: ciem\n  scenarioType: native\n  platform: aws\n  config:\n    key: value\n```\n\nLet's break down this example to learn about the different fields:\n\n* `name`: The name of the scenario. This name is used by Pulumi to identify the scenario. \nOur naming convention is `\u003cmodule\u003e-\u003cplatform\u003e-\u003cscenario-name-kebab-case\u003e`\n* `runtime`: The programming language used by the scenario, you can use whatever [Pulumi\nsupported runtime](https://www.pulumi.com/docs/concepts/projects/project-file/#runtime-options) you prefer: \n`nodejs`, `python`, `go`, `dotnet`, `java` or `yaml`\n* `description`: A description of the scenario. This description is used by Pulumi to describe the scenario. **Note:**\n  **This description can only be up top 256 characters long!**\n* `cnappgoat-params`: these are the parameters that CNAPPgoat uses.\n  * `description`: A description of the scenario. This description is used by CNAPPgoat to describe the scenario.\nIts length is **not** limited\n  * `friendlyName`: A friendly name of the scenario. This name is used by CNAPPgoat to describe the scenario. The\nconvention for this name is `Capitalized Scenario Name`\n  * `id`: The ID of the scenario. This ID is used by CNAPPgoat to identify the scenario. Our naming convention is\n`\u003cmodule\u003e-\u003cplatform\u003e-\u003cscenario-name-kebab-case\u003e`\n  * `module`: The module of the scenario. This module is used by CNAPPgoat to identify the module of the scenario.\n(e.g. `ciem`, `cspm`, `cwpp`, etc.)\n  * `scenarioType`: The type of the scenario. All scenarios in this repository are `native` scenarios.\n    * `config`: The configuration of the scenario. CNAPPgoat takes key value pairs under this yaml field and sets them\nas environment variables for the Pulumi program, as if you ran `pulumi config set \u003ckey\u003e \u003cvalue\u003e` for each key value pair.\n### The Pulumi Program\nIn the same directory as the `Pulumi.yaml` file, you should put the Pulumi program. The Pulumi program is a program\nwritten in the programming language specified in the `Pulumi.yaml` file. This program is used by Pulumi to deploy\nthe scenario.\n#### Go\nAs of now, all scenarios in this repository are written in Go. \nThe `main.go` file is the main program for the scenario. It uses the Pulumi SDK to define resources and their\nconfigurations.\n\nIn addition, when adding Go scenarios, you should also add a `go.mod` file and a `go.sum` file.\n\n#### Other Best Practices\nThese program files are just standard Pulumi programs, so you can use the \n[Pulumi documentation](https://www.pulumi.com/docs/) when writing them. There are a few conventions that you should \nfollow when writing scenarios for CNAPPgoat:\n* **Resource names** should start with `CNAPPGoat` and be as descriptive as possible.\n* **Tags**: Whenever possible, tag resources with `{\"Cnappgoat\": \"true\"}`, do note that\ntags can be case-sensitive.\n* **Output values**: Whenever possible, output values that are relevant to the scenario. For now, these are not used\nby CNAPPgoat, but it is best practice to reflect them.\n  * **Region independence**: Whenever possible, write scenarios in a way that they can be deployed in any region. \n  You can look at [scenarios/cwpp/aws/end-of-life-ec2](scenarios/cwpp/aws/end-of-life-ec2) for an example of how to do\n  this.\n  Other than that, try to stick to the best practices and conventions of the programming language you are using.\n\n### Testing your scenario\nTo test your scenario, just put it into your local directory under the proper directory structure,\ne.g. `$HOME/cnappgoat/scenarios/\u003cmodule\u003e/\u003cplatform\u003e/\u003cscenario-name\u003e` and run `cnappgoat provision \n--debug \u003cmodule\u003e-\u003cplatform\u003e-\u003cscenario-name\u003e` to deploy it to a sandbox environment you own.\n\n### Containers and Images\nTo ensure security, CNAPPgoat scenarios in this repository will only used trusted images/containers or images/containers stored\nby the Ermetic Research team. If your scenario uses a custom container,\nplease [contact the project team](mailto:research+cnappgoat@ermetic.com).\n## Contact\n\nTo email the project team, contact [research+cnappgoat@ermetic.com](mailto:research+cnappgoat@ermetic.com)\n\n## Disclaimer\n\n* CNAPPGoat scenarios are provided \"as is\" and without any warranty or support.\n* This is a beta version. The project is still in development, so we apologize for any growing pains. We will release a\n  stable version in the coming weeks.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftenable%2Fcnappgoat-scenarios","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftenable%2Fcnappgoat-scenarios","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftenable%2Fcnappgoat-scenarios/lists"}