Snyk IaCの結果をWeb UIに直接出力する

data "aws_availability_zones" "azs" {
  all_availability_zones = false
  state = "available"
}

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  azs             = data.aws_availability_zones.azs.names
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway = false
  enable_vpn_gateway = false

  tags = {}
}

resource "aws_s3_bucket" "bucket" {
  bucket = "snyk-test-bucket"
}

terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tf-plan.json

snyk iac test tf-plan.json --report

Snyk Infrastructure as Code

✔ Test completed.

Issues

Low Severity Issues: 6

  [Low] Public IPs are automatically mapped to instances
  Info:    Instances launched in this subnet will automatically have public IP assigned. Instances will be potentially accessible over public internet, which may lead to unauthorized access
  Rule:    https://snyk.io/security-rules/SNYK-CC-AWS-427
  Path:    resource > aws_subnet[public["2"]] > map_public_ip_on_launch
  File:    tf-plan.json
  Resolve: Set `map_public_ip_on_launch` attribute  with value `true`

  [Low] Public IPs are automatically mapped to instances
  Info:    Instances launched in this subnet will automatically have public IP assigned. Instances will be potentially accessible over public internet, which may lead to unauthorized access
  Rule:    https://snyk.io/security-rules/SNYK-CC-AWS-427
  Path:    resource > aws_subnet[public["0"]] > map_public_ip_on_launch
  File:    tf-plan.json
  Resolve: Set `map_public_ip_on_launch` attribute  with value `true`

  [Low] Public IPs are automatically mapped to instances
  Info:    Instances launched in this subnet will automatically have public IP assigned. Instances will be potentially accessible over public internet, which may lead to unauthorized access
  Rule:    https://snyk.io/security-rules/SNYK-CC-AWS-427
  Path:    resource > aws_subnet[public["1"]] > map_public_ip_on_launch
  File:    tf-plan.json
  Resolve: Set `map_public_ip_on_launch` attribute  with value `true`

  [Low] S3 bucket versioning disabled
  Info:    S3 bucket versioning is disabled. Changes or deletion of objects will not be reversible
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-124
  Path:    resource > aws_s3_bucket[bucket] > versioning > enabled
  File:    tf-plan.json
  Resolve: For AWS provider < v4.0.0, set `versioning.enabled` attribute to `true`. For AWS provider >= v4.0.0, add aws_s3_bucket_versioning resource.

  [Low] S3 bucket MFA delete control disabled
  Info:    S3 bucket will not enforce MFA login on delete requests. Object could be deleted without stronger MFA authorization
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-127
  Path:    resource > aws_s3_bucket[bucket] > versioning > mfa_delete
  File:    tf-plan.json
  Resolve: Follow instructions in `https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html` to manually configure the MFA setting. For AWS provider < v4.0.0 set `versioning.mfa_delete` attribute to `true` in aws_s3_bucket resource. For AWS provider >= v4.0.0 set 'versioning_configuration.mfa_delete` attribute to `Enabled`. The terraform change is required to reflect the setting in the state file

  [Low] S3 server access logging is disabled
  Info:    The s3 access logs will not be collected. There will be no audit trail of access to s3 objects
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-45
  Path:    input > resource > aws_s3_bucket[bucket] > logging
  File:    tf-plan.json
  Resolve: For AWS provider < v4.0.0, add `logging` block attribute. For AWS provider >= v4.0.0, add aws_s3_bucket_logging resource.

Medium Severity Issues: 1

  [Medium] Non-encrypted S3 Bucket
  Info:    Non-encrypted S3 Bucket. A non-encrypted S3 bucket increases the likelihood of unintentional data exposure
  Rule:    https://snyk.io/security-rules/SNYK-CC-TF-4
  Path:    input > resource > aws_s3_bucket[bucket]
  File:    tf-plan.json
  Resolve: For AWS provider < v4.0.0, set `server_side_encryption_configuration` block attribute. For AWS provider >= v4.0.0 add aws_s3_bucket_server_side_encryption_configuration resource.

-------------------------------------------------------

Test Summary

  Organization: takakuni
  Project name: snyk_iac_test

✔ Files without issues: 0
✗ Files with issues: 1
  Ignored issues: 0
  Total issues: 7 [ 0 critical, 0 high, 1 medium, 6 low ]

-------------------------------------------------------

Report Complete

  Your test results are available at: https://snyk.io/org/takakuni/projects
  under the name: snyk_iac_test

snyk iac test tf-plan.json --report \
--project-tags=team=takakuni \
--project-business-criticality=low \
--project-environment=backend \
--project-lifecycle=sandbox