Wildcard In ACM Certificate Domain Name
- Query id: cc8b294f-006f-4f8f-b5bb-0a9140c33131
- Query name: Wildcard In ACM Certificate Domain Name
- Platform: CloudFormation
- Severity: Low
- Category: Insecure Configurations
- URL: Github
Description¶
ACM Certificate should not use wildcards (*) in the domain name
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
DomainName:
Description: "Domain for which you are requesting a cert"
Type: String
Default: example.com #Put your own domain name here
HostedZoneId:
Description: "hosted zone id in which CNAME record for the validation needs to be added"
Type: String
Default: XYZABCDERYH #Put the hosted zone id in which CNAME record for the validation needs to be added
Resources:
Certificate:
Type: AWS::CertificateManager::Certificate
Properties:
DomainName: "*"
DomainValidationOptions:
- DomainName: !Ref DomainName
HostedZoneId: !Ref HostedZoneId
ValidationMethod: 'DNS'
Postitive test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"HostedZoneId": {
"Type": "String",
"Default": "XYZABCDERYH",
"Description": "hosted zone id in which CNAME record for the validation needs to be added"
},
"DomainName": {
"Description": "Domain for which you are requesting a cert",
"Type": "String",
"Default": "example.com"
}
},
"Resources": {
"Certificate": {
"Type": "AWS::CertificateManager::Certificate",
"Properties": {
"DomainName": "*",
"DomainValidationOptions": [
{
"DomainName": "DomainName",
"HostedZoneId": "HostedZoneId"
}
],
"ValidationMethod": "DNS"
}
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
DomainName:
Description: "Domain for which you are requesting a cert"
Type: String
Default: example.com #Put your own domain name here
HostedZoneId:
Description: "hosted zone id in which CNAME record for the validation needs to be added"
Type: String
Default: XYZABCDERYH #Put the hosted zone id in which CNAME record for the validation needs to be added
Resources:
Certificate:
Type: AWS::CertificateManager::Certificate
Properties:
DomainName: CMDomain
DomainValidationOptions:
- DomainName: !Ref DomainName
HostedZoneId: !Ref HostedZoneId
ValidationMethod: 'DNS'
Negative test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"DomainName": {
"Type": "String",
"Default": "example.com",
"Description": "Domain for which you are requesting a cert"
},
"HostedZoneId": {
"Description": "hosted zone id in which CNAME record for the validation needs to be added",
"Type": "String",
"Default": "XYZABCDERYH"
}
},
"Resources": {
"Certificate": {
"Type": "AWS::CertificateManager::Certificate",
"Properties": {
"DomainName": "CMDomain",
"DomainValidationOptions": [
{
"HostedZoneId": "HostedZoneId",
"DomainName": "DomainName"
}
],
"ValidationMethod": "DNS"
}
}
}
}