Best practices for AWS
Recipe ID
org.openrewrite.terraform.aws.AWSBestPracticesArtifactorg.openrewrite.recipe:rewrite-terraformSecurely operate on Amazon Web Services.
Composite recipeAWSterraformProprietary
Add to your build
Get a download tokenThis recipe is Moderne licensed, so the token must belong to a Moderne customer. It replaces YOUR_DOWNLOAD_TOKEN below.
~/.gradle/gradle.properties
codeGenomeUsername=you@example.com
codeGenomeToken=YOUR_DOWNLOAD_TOKEN
build.gradle.kts
plugins {
id("org.openrewrite.rewrite") version("latest.release")
}
rewrite {
activeRecipe("org.openrewrite.terraform.aws.AWSBestPractices")
}
repositories {
mavenCentral()
maven {
url = uri("https://artifacts.codegenomeproject.org/maven")
credentials {
username = providers.gradleProperty("codeGenomeUsername").get()
password = providers.gradleProperty("codeGenomeToken").get()
}
}
}
dependencies {
rewrite("org.openrewrite.recipe:rewrite-terraform:3.15.0")
}
Then run
./gradlew rewriteRunUsage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.terraform.aws.AWSBestPracticesIf the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-terraform:RELEASEDefinition
This recipe runs the following recipes in order.
- Encrypt EBS volumes
org.openrewrite.terraform.aws.EncryptEBSVolumes - Encrypt EBS snapshots
org.openrewrite.terraform.aws.EncryptEBSSnapshots - Ensure AWS Elasticsearch domain encryption for data at rest is enabled
org.openrewrite.terraform.aws.EnsureAWSElasticsearchDomainEncryptionForDataAtRestIsEnabled - Ensure AWS Elasticsearch has node-to-node encryption enabled
org.openrewrite.terraform.aws.EnsureAWSElasticsearchHasNodeToNodeEncryptionEnabled - Ensure AWS CMK rotation is enabled
org.openrewrite.terraform.aws.EnsureAWSCMKRotationIsEnabled - Encrypt EBS volume launch configurations
org.openrewrite.terraform.aws.EncryptEBSVolumeLaunchConfiguration - Ensure IAM password policy expires passwords within 90 days or less
org.openrewrite.terraform.aws.EnsureIAMPasswordPolicyExpiresPasswordsWithin90DaysOrLess - Ensure AWS IAM password policy has a minimum of 14 characters
org.openrewrite.terraform.aws.EnsureAWSIAMPasswordPolicyHasAMinimumOf14Characters - Ensure IAM password policy requires at least one lowercase letter
org.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneLowercaseLetter - Ensure IAM password policy requires at least one number
org.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneNumber - Ensure IAM password policy prevents password reuse
org.openrewrite.terraform.aws.EnsureIAMPasswordPolicyPreventsPasswordReuse - Ensure IAM password policy requires at least one symbol
org.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneSymbol - Ensure IAM password policy requires at least one uppercase letter
org.openrewrite.terraform.aws.EnsureIAMPasswordPolicyRequiresAtLeastOneUppercaseLetter - Encrypt RDS clusters
org.openrewrite.terraform.aws.EncryptRDSClusters - Ensure AWS RDS database instance is not publicly accessible
org.openrewrite.terraform.aws.EnsureAWSRDSDatabaseInstanceIsNotPubliclyAccessible - Ensure data stored in an S3 bucket is securely encrypted at rest
org.openrewrite.terraform.aws.EnsureDataStoredInAnS3BucketIsSecurelyEncryptedAtRest - Ensure AWS S3 object versioning is enabled
org.openrewrite.terraform.aws.EnsureAWSS3ObjectVersioningIsEnabled - Enable point-in-time recovery for DynamoDB
org.openrewrite.terraform.aws.EnableDynamoDbPITR - Encrypt ElastiCache Redis at rest
org.openrewrite.terraform.aws.EncryptElastiCacheRedisAtRest - Encrypt ElastiCache Redis in transit
org.openrewrite.terraform.aws.EncryptElastiCacheRedisInTransit - Scan images pushed to ECR
org.openrewrite.terraform.aws.EnableECRScanOnPush - Use HTTPS for Cloudfront distribution
org.openrewrite.terraform.aws.UseHttpsForCloudfrontDistribution - Ensure CloudTrail log file validation is enabled
org.openrewrite.terraform.aws.EnsureCloudTrailLogFileValidationIsEnabled - Ensure Amazon EKS control plane logging enabled for all log types
org.openrewrite.terraform.aws.EnsureAmazonEKSControlPlaneLoggingEnabledForAllLogTypes - Ensure AWS EKS cluster endpoint access is publicly disabled
org.openrewrite.terraform.aws.EnsureAWSEKSClusterEndpointAccessIsPubliclyDisabled - Ensure AWS EFS with encryption for data at rest is enabled
org.openrewrite.terraform.aws.EnsureAWSEFSWithEncryptionForDataAtRestIsEnabled - Ensure Kinesis Stream is securely encrypted
org.openrewrite.terraform.aws.EnsureKinesisStreamIsSecurelyEncrypted - Encrypt Neptune storage
org.openrewrite.terraform.aws.EncryptNeptuneStorage - Encrypt DAX storage at rest
org.openrewrite.terraform.aws.EncryptDAXStorage - Ensure AWS Lambda functions have tracing enabled
org.openrewrite.terraform.aws.EnsureAWSLambdaFunctionsHaveTracingEnabled - Make ECR tags immutable
org.openrewrite.terraform.aws.ImmutableECRTags - Encrypt Redshift storage at rest
org.openrewrite.terraform.aws.EncryptRedshift - Encrypt DocumentDB storage
org.openrewrite.terraform.aws.EncryptDocumentDB - Disable Instance Metadata Service version 1
org.openrewrite.terraform.aws.DisableInstanceMetadataServiceV1 - Ensure AWS Elasticsearch domains have
EnforceHTTPSenabledorg.openrewrite.terraform.aws.EnsureAWSElasticsearchDomainsHaveEnforceHTTPSEnabled - Encrypt Aurora clusters
org.openrewrite.terraform.aws.EncryptAuroraClusters - Encrypt EFS Volumes in ECS Task Definitions in transit
org.openrewrite.terraform.aws.EncryptEFSVolumesInECSTaskDefinitionsInTransit - Ensure AWS Lambda function is configured for function-level concurrent execution limit
org.openrewrite.terraform.aws.EnsureAWSLambdaFunctionIsConfiguredForFunctionLevelConcurrentExecutionLimit - Ensure enhanced monitoring for Amazon RDS instances is enabled
org.openrewrite.terraform.aws.EnsureEnhancedMonitoringForAmazonRDSInstancesIsEnabled - Enable API gateway caching
org.openrewrite.terraform.aws.EnableApiGatewayCaching - Ensure detailed monitoring for EC2 instances is enabled
org.openrewrite.terraform.aws.EnsureDetailedMonitoringForEC2InstancesIsEnabled - Ensure respective logs of Amazon RDS are enabled
org.openrewrite.terraform.aws.EnsureRespectiveLogsOfAmazonRDSAreEnabled - Ensure VPC subnets do not assign public IP by default
org.openrewrite.terraform.aws.EnsureVPCSubnetsDoNotAssignPublicIPByDefault - Ensure EC2 is EBS optimized
org.openrewrite.terraform.aws.EnsureEC2IsEBSOptimized - Ensure ECR repositories are encrypted
org.openrewrite.terraform.aws.EnsureECRRepositoriesAreEncrypted - Encrypt CodeBuild projects
org.openrewrite.terraform.aws.EncryptCodeBuild - Ensure RDS instances have Multi-AZ enabled
org.openrewrite.terraform.aws.EnsureRDSInstancesHaveMultiAZEnabled - Ensure RDS database has IAM authentication enabled
org.openrewrite.terraform.aws.EnsureRDSDatabaseHasIAMAuthenticationEnabled
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats