tenable / kaimonkey

KaiMonkey provides vulnerable infrastructure as code (IaC) to help explore and understand common cloud security threats exposed via IaC.

KaiMonkey - Vulnerable Terraform Infrastructure

KaiMonkey provides vulnerable infrastructure as code (IaC) to help explore and understand common cloud security threats exposed via IaC.

Introduction

KaiMonkey is an effort to provide a playground of vulnerable infrastructure as code to help analyze & strategize the approach to be taken to secure from code to cloud.

The project can help you get familiar with IaC security issues and verify that your IaC scanner is working. The project is maintained and enhanced over time to increase the types of problems represented and to add support for additional IaC and Cloud providers. Contributions are welcome.

To learn more about the security risks in KaiMonkey, you can leverage Terrascan, our open-source tool to detect compliance and security violations before provisioning the infrastructure. You can also use the Tenable.cs platform for an experience that extends beyond the command line with a SaaS console and pre-built integrations into your source code repositories, ticketing systems, CI/CD pipelines, etc.

Where to get help

• To learn more about Terrascan's features and capabilities, see the documentation portal: https://runterrascan.io

Join our community

KaiMonkey Pre-requisites

• Terraform 0.12
• aws cli
• azure cli
• Optional - Terrascan open source tool to scan KaiMonkey

Getting Started with KaiMonkey

1. git clone https://github.com/tenable/KaiMonkey.git
2. cd KaiMonkey/terraform/aws/
3. terraform init
4. terraform plan ⟵ optional
5. terraform apply

Getting Started with Terrascan

Docker is typically the easiest way to get started because you don't need to install Terrascan on your system. Terrascan builds are also available from the releases page.

With Docker

1. git clone https://github.com/tenable/KaiMonkey.git
2. cd KaiMonkey/terraform/aws
3. docker run --rm -v "$(pwd):/iac" -w /iac tenable/terrascan scan -t aws

With native executables

0. Download the appropriate binary from the releases page.
1. git clone https://github.com/tenable/KaiMonkey.git
2. cd KaiMonkey/terraform/aws
3. path/to/terrascan scan -t aws

kaimonkey's Issues

Auto created Accurics issue: Fix IaC violations in "storebot-patch-2" branch

[HIGH]: https port open to internet
[HIGH]: RDS storage Encryption at rest
[HIGH]: S3 bucket should have versioning enabled
[HIGH]: S3 bucket accessible to all authenticated users.
[HIGH]: Ensure the RDS instance follows standard configuration
[HIGH]: Postgres SQL (TCP:5432) is exposed to the entire internet
[HIGH]: S3 Buckets Server Side Encryption At Rest
[HIGH]: http port open to internet
[MEDIUM]: Instances are Configured under Virtual Private Cloud
[MEDIUM]: Ensure VPC flow logging is enabled in all VPCs
[HIGH]: Ensure RDS Automated Backups are Enabled

Azure not yet supported?

I see mention of azure in the pre-reqs, but no sign of azure tf code...

Accurics identified issue in "master" branch

[HIGH]: https port open to internet

• terraform/aws/modules/network/main.tf line:102

[MEDIUM]: Ensure VPC flow logging is enabled in all VPCs

• terraform/aws/modules/network/main.tf line:4

[HIGH]: Ensure the RDS instance follows standard configuration

• terraform/aws/modules/storage/main.tf line:45
• terraform/aws/modules/storage/main.tf line:45
• terraform/aws/modules/storage/main.tf line:45
• terraform/aws/modules/storage/main.tf line:45
• terraform/aws/modules/storage/main.tf line:45

[HIGH]: S3 Buckets Server Side Encryption At Rest

• terraform/aws/modules/storage/main.tf line:104
• terraform/aws/modules/storage/main.tf line:112

[HIGH]: S3 bucket should have versioning enabled

• terraform/aws/modules/storage/main.tf line:104
• terraform/aws/modules/storage/main.tf line:112

[MEDIUM]: Instances are Configured under Virtual Private Cloud

• terraform/aws/modules/compute/main.tf line:124

[HIGH]: Ensure RDS Automated Backups are Enabled

• terraform/aws/modules/storage/main.tf line:45

[HIGH]: S3 bucket accessible to all authenticated users.

• terraform/aws/modules/storage/main.tf line:104
• terraform/aws/modules/storage/main.tf line:112

[HIGH]: Postgres SQL (TCP:5432) is exposed to the entire internet

• terraform/aws/modules/storage/main.tf line:10

[HIGH]: http port open to internet

• terraform/aws/modules/network/main.tf line:102

Auto created Accurics issue: Fix IaC violations in "master" branch

[MEDIUM]: Instances are Configured under Virtual Private Cloud
[MEDIUM]: Ensure VPC flow logging is enabled in all VPCs
[HIGH]: Postgres SQL (TCP:5432) is exposed to the entire internet
[HIGH]: S3 bucket should have versioning enabled
[HIGH]: S3 bucket accessible to all authenticated users.
[HIGH]: http port open to internet
[HIGH]: https port open to internet
[HIGH]: Ensure RDS Automated Backups are Enabled
[HIGH]: Ensure the RDS instance follows standard configuration
[HIGH]: RDS storage Encryption at rest
[HIGH]: S3 Buckets Server Side Encryption At Rest