Best practices for AWS

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.terraform.aws.AWSBestPractices

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-terraform:3.14.6

Definition

This recipe runs the following recipes in order.

• Encrypt EBS volumesorg.openrewrite.terraform.aws.EncryptEBSVolumes
• Encrypt EBS snapshotsorg.openrewrite.terraform.aws.EncryptEBSSnapshots
• Ensure AWS Elasticsearch domain encryption for data at rest is enabledorg.openrewrite.terraform.aws.EnsureAWSElasticsearchDomainEncryptionForDataAtRestIsEnabled
• Ensure AWS Elasticsearch has node-to-node encryption enabledorg.openrewrite.terraform.aws.EnsureAWSElasticsearchHasNodeToNodeEncryptionEnabled
• Ensure AWS CMK rotation is enabledorg.openrewrite.terraform.aws.EnsureAWSCMKRotationIsEnabled
• Encrypt EBS volume launch configurationsorg.openrewrite.terraform.aws.EncryptEBSVolumeLaunchConfiguration
• Ensure IAM password policy expires passwords within 90 days or lessorg.openrewrite.terraform.aws.EnsureIAMPasswordPolicyExpiresPasswordsWithin90DaysOrLess
• Ensure AWS IAM password policy has a minimum of 14 charactersorg.openrewrite.terraform.aws.EnsureAWSIAMPasswordPolicyHasAMinimumOf14Characters
• Ensure IAM password policy requires at least one lowercase letterorg.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneLowercaseLetter
• Ensure IAM password policy requires at least one numberorg.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneNumber
• Ensure IAM password policy prevents password reuseorg.openrewrite.terraform.aws.EnsureIAMPasswordPolicyPreventsPasswordReuse
• Ensure IAM password policy requires at least one symbolorg.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneSymbol
• Ensure IAM password policy requires at least one uppercase letterorg.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneUppercaseLetter
• Encrypt RDS clustersorg.openrewrite.terraform.aws.EncryptRDSClusters
• Ensure AWS RDS database instance is not publicly accessibleorg.openrewrite.terraform.aws.EnsureAWSRDSDatabaseInstanceIsNotPubliclyAccessible
• Ensure data stored in an S3 bucket is securely encrypted at restorg.openrewrite.terraform.aws.EnsureDataStoredInAnS3BucketIsSecurelyEncryptedAtRest
• Ensure AWS S3 object versioning is enabledorg.openrewrite.terraform.aws.EnsureAWSS3ObjectVersioningIsEnabled
• Enable point-in-time recovery for DynamoDBorg.openrewrite.terraform.aws.EnableDynamoDbPITR
• Encrypt ElastiCache Redis at restorg.openrewrite.terraform.aws.EncryptElastiCacheRedisAtRest
• Encrypt ElastiCache Redis in transitorg.openrewrite.terraform.aws.EncryptElastiCacheRedisInTransit
• Scan images pushed to ECRorg.openrewrite.terraform.aws.EnableECRScanOnPush
• Use HTTPS for Cloudfront distributionorg.openrewrite.terraform.aws.UseHttpsForCloudfrontDistribution
• Ensure CloudTrail log file validation is enabledorg.openrewrite.terraform.aws.EnsureCloudTrailLogFileValidationIsEnabled
• Ensure Amazon EKS control plane logging enabled for all log typesorg.openrewrite.terraform.aws.EnsureAmazonEKSControlPlaneLoggingEnabledForAllLogTypes
• Ensure AWS EKS cluster endpoint access is publicly disabledorg.openrewrite.terraform.aws.EnsureAWSEKSClusterEndpointAccessIsPubliclyDisabled
• Ensure AWS EFS with encryption for data at rest is enabledorg.openrewrite.terraform.aws.EnsureAWSEFSWithEncryptionForDataAtRestIsEnabled
• Ensure Kinesis Stream is securely encryptedorg.openrewrite.terraform.aws.EnsureKinesisStreamIsSecurelyEncrypted
• Encrypt Neptune storageorg.openrewrite.terraform.aws.EncryptNeptuneStorage
• Encrypt DAX storage at restorg.openrewrite.terraform.aws.EncryptDAXStorage
• Ensure AWS Lambda functions have tracing enabledorg.openrewrite.terraform.aws.EnsureAWSLambdaFunctionsHaveTracingEnabled
• Make ECR tags immutableorg.openrewrite.terraform.aws.ImmutableECRTags
• Encrypt Redshift storage at restorg.openrewrite.terraform.aws.EncryptRedshift
• Encrypt DocumentDB storageorg.openrewrite.terraform.aws.EncryptDocumentDB
• Disable Instance Metadata Service version 1org.openrewrite.terraform.aws.DisableInstanceMetadataServiceV1
• Ensure AWS Elasticsearch domains have EnforceHTTPS enabledorg.openrewrite.terraform.aws.EnsureAWSElasticsearchDomainsHaveEnforceHTTPSEnabled
• Encrypt Aurora clustersorg.openrewrite.terraform.aws.EncryptAuroraClusters
• Encrypt EFS Volumes in ECS Task Definitions in transitorg.openrewrite.terraform.aws.EncryptEFSVolumesInECSTaskDefinitionsInTransit
• Ensure AWS Lambda function is configured for function-level concurrent execution limitorg.openrewrite.terraform.aws.EnsureAWSLambdaFunctionIsConfiguredForFunctionLevelConcurrentExecutionLimit
• Ensure enhanced monitoring for Amazon RDS instances is enabledorg.openrewrite.terraform.aws.EnsureEnhancedMonitoringForAmazonRDSInstancesIsEnabled
• Enable API gateway cachingorg.openrewrite.terraform.aws.EnableApiGatewayCaching
• Ensure detailed monitoring for EC2 instances is enabledorg.openrewrite.terraform.aws.EnsureDetailedMonitoringForEC2InstancesIsEnabled
• Ensure respective logs of Amazon RDS are enabledorg.openrewrite.terraform.aws.EnsureRespectiveLogsOfAmazonRDSAreEnabled
• Ensure VPC subnets do not assign public IP by defaultorg.openrewrite.terraform.aws.EnsureVPCSubnetsDoNotAssignPublicIPByDefault
• Ensure EC2 is EBS optimizedorg.openrewrite.terraform.aws.EnsureEC2IsEBSOptimized
• Ensure ECR repositories are encryptedorg.openrewrite.terraform.aws.EnsureECRRepositoriesAreEncrypted
• Encrypt CodeBuild projectsorg.openrewrite.terraform.aws.EncryptCodeBuild
• Ensure RDS instances have Multi-AZ enabledorg.openrewrite.terraform.aws.EnsureRDSInstancesHaveMultiAZEnabled
• Ensure RDS database has IAM authentication enabledorg.openrewrite.terraform.aws.EnsureRDSDatabaseHasIAMAuthenticationEnabled

Data tables

Structured output this recipe can produce.

• Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
• Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
• Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
• Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats