Stack Without Template
- Query id: 32d31f1f-0f83-4721-b7ec-1e6948c60145
- Query name: Stack Without Template
- Platform: Ansible
- Severity: Medium
- Category: Build Process
- URL: Github
Description¶
AWS CloudFormation should have a template defined through the attribute template, template_url or attribute template_body
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
- name: create a stack, pass in the template via an URL
amazon.aws.cloudformation:
stack_name: "ansible-cloudformation"
state: present
region: us-east-1
disable_rollback: true
template_parameters:
KeyName: jmartin
DiskType: ephemeral
InstanceType: m1.small
ClusterSize: 3
tags:
Stack: ansible-cloudformation
- name: create a stack, pass in the template via an URL v2
amazon.aws.cloudformation:
stack_name: "ansible-cloudformation"
state: present
region: us-east-1
disable_rollback: true
template_url: https://s3.amazonaws.com/my-bucket/cloudformation.template
template_body: "{{ lookup('template', 'cloudformation.j2') }}"
template_parameters:
KeyName: jmartin
DiskType: ephemeral
InstanceType: m1.small
ClusterSize: 3
tags:
Stack: ansible-cloudformation
- name: Create a stack set with instances in two accounts
community.aws.cloudformation_stack_set:
name: my-stack
description: Test stack in two accounts
state: present
template_url: https://s3.amazonaws.com/my-bucket/cloudformation.template
template_body: "{{ lookup('template', 'cloudformation.j2') }}"
accounts: [1234567890, 2345678901]
regions:
- us-east-1
- name: Create a stack set with instances in two accounts v2
community.aws.cloudformation_stack_set:
name: my-stack
description: Test stack in two accounts
state: present
accounts: [1234567890, 2345678901]
regions:
- us-east-1
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
- name: create a stack, pass in the template body via lookup template v3
amazon.aws.cloudformation:
stack_name: ansible-cloudformation
state: present
region: us-east-1
disable_rollback: true
template_body: "{{ lookup('template', 'cloudformation.j2') }}"
template_parameters:
KeyName: jmartin
DiskType: ephemeral
InstanceType: m1.small
ClusterSize: 3
tags:
Stack: ansible-cloudformation
- name: create a stack, pass in the template via an URL v4
amazon.aws.cloudformation:
stack_name: ansible-cloudformation
state: present
region: us-east-1
disable_rollback: true
template_url: https://s3.amazonaws.com/my-bucket/cloudformation.template
template_parameters:
KeyName: jmartin
DiskType: ephemeral
InstanceType: m1.small
ClusterSize: 3
tags:
Stack: ansible-cloudformation
- name: Create a stack set with instances in two accounts v5
community.aws.cloudformation_stack_set:
name: my-stack
description: Test stack in two accounts
state: present
template_url: https://s3.amazonaws.com/my-bucket/cloudformation.template
accounts: [1234567890, 2345678901]
regions:
- us-east-1