| ID | Severity | Category | Resource | Threat Description |
|---|---|---|---|---|
| T-001 | CRITICAL | Elevation of Privilege | app_role |
IAM role 'app_role' trust policy allows Principal:* — any entity can assume this role.
Mitigation: Restrict the Principal in the trust policy to specific AWS accounts, services, or roles.
|
| T-002 | CRITICAL | Information Disclosure | customer_data |
S3 bucket 'customer_data' has no public access block configured — bucket may be publicly accessible.
Mitigation: Enable S3 Block Public Access on the bucket and at the account level.
resource "aws_s3_bucket_public_access_block" "pab" {
bucket = aws_s3_bucket.example.id
block_public_acls = true
}
|
| T-003 | CRITICAL | Spoofing | web_sg |
Security group 'web_sg' exposes SSH/RDP (port 22/3389) to 0.0.0.0/0.
Mitigation: Remove public SSH/RDP access. Use AWS Systems Manager Session Manager or a bastion host with IP restrictions.
|
| T-004 | HIGH | Information Disclosure | customer_data |
S3 bucket 'customer_data' does not have server-side encryption configured.
Mitigation: Add a server_side_encryption_configuration block using AES256 or aws:kms.
resource "aws_s3_bucket_server_side_encryption_configuration" "sse" {
bucket = aws_s3_bucket.example.id
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
}
|
| T-005 | HIGH | Elevation of Privilege | web_server |
EC2 instance 'web_server' allows IMDSv1 — metadata service is accessible without session tokens, enabling SSRF-based credential theft.
Mitigation: Set metadata_options { http_tokens = "required" } to enforce IMDSv2.
|
| T-006 | HIGH | Spoofing | web_sg |
Security group 'web_sg' allows inbound traffic from 0.0.0.0/0.
Mitigation: Restrict ingress rules to known CIDR ranges or security group references.
|
| T-007 | MEDIUM | Tampering | customer_data |
S3 bucket 'customer_data' does not have versioning enabled — objects can be overwritten or deleted without recovery.
Mitigation: Enable versioning on the S3 bucket.
|
| T-008 | MEDIUM | Repudiation | customer_data |
S3 bucket 'customer_data' does not have access logging enabled — activity cannot be audited.
Mitigation: Enable S3 server access logging and direct logs to a dedicated audit bucket.
|
| T-009 | MEDIUM | Tampering | customer_data |
Production buckets should not have force_destroy enabled to prevent accidental data loss.
Mitigation: Set force_destroy = false.
force_destroy = false
|
| T-010 | MEDIUM | Information Disclosure | web_server |
EC2 instance 'web_server' root EBS volume is not encrypted.
Mitigation: Set encrypted = true in the root_block_device block, or enable EBS encryption by default in the region.
|