CloudFront Without WAF
- Query id: 6d19ce0f-b3d8-4128-ac3d-1064e0f00494
- Query name: CloudFront Without WAF
- Platform: Crossplane
- Severity: Low
- Category: Networking and Firewall
- URL: Github
Description¶
All AWS CloudFront distributions should be integrated with the Web Application Firewall (AWS WAF) service
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
apiVersion: cloudfront.aws.crossplane.io/v1alpha1
kind: Distribution
metadata:
name: sample-distribution
spec:
forProvider:
region: us-east-1
distributionConfig:
enabled: true
comment: Crossplane - auto provisioning
viewerCertificate:
sslSupportMethod: sni-only
cloudFrontDefaultCertificate: false
minimumProtocolVersion: TLSv1.2_2018
origins:
items:
- domainName: sample.s3.amazonaws.com
id: s3Origin
s3OriginConfig:
originAccessIDentity: ""
---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: cluster-aws
labels:
provider: aws
cluster: eks
spec:
compositeTypeRef:
apiVersion: mydev.org/v1alpha1
kind: CompositeCluster
writeConnectionSecretsToNamespace: crossplane-system
patchSets:
- name: metadata
patches:
- fromFieldPath: metadata.labels
resources:
- name: sample-cloudfront
base:
apiVersion: cloudfront.aws.crossplane.io/v1alpha1
kind: Distribution
metadata:
name: sample-distribution
spec:
forProvider:
region: us-east-1
distributionConfig:
enabled: true
comment: Crossplane - auto provisioning
viewerCertificate:
sslSupportMethod: sni-only
cloudFrontDefaultCertificate: false
minimumProtocolVersion: TLSv1.2_2018
origins:
items:
- domainName: sample.s3.amazonaws.com
id: s3Origin
s3OriginConfig:
originAccessIDentity: ""
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
apiVersion: cloudfront.aws.crossplane.io/v1alpha1
kind: Distribution
metadata:
name: sample-distribution
spec:
forProvider:
region: us-east-1
distributionConfig:
enabled: true
comment: Crossplane - auto provisioning
viewerCertificate:
sslSupportMethod: sni-only
cloudFrontDefaultCertificate: false
minimumProtocolVersion: TLSv1.2_2018
webACLID: 473e64fd-f30b-4765-81a0-62ad96dd167a
origins:
items:
- domainName: sample.s3.amazonaws.com
id: s3Origin
s3OriginConfig:
originAccessIDentity: ""
---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: cluster-aws
labels:
provider: aws
cluster: eks
spec:
compositeTypeRef:
apiVersion: mydev.org/v1alpha1
kind: CompositeCluster
writeConnectionSecretsToNamespace: crossplane-system
patchSets:
- name: metadata
patches:
- fromFieldPath: metadata.labels
resources:
- name: sample-cloudfront
base:
apiVersion: cloudfront.aws.crossplane.io/v1alpha1
kind: Distribution
metadata:
name: sample-distribution
spec:
forProvider:
region: us-east-1
distributionConfig:
enabled: true
comment: Crossplane - auto provisioning
viewerCertificate:
sslSupportMethod: sni-only
cloudFrontDefaultCertificate: false
minimumProtocolVersion: TLSv1.2_2018
webACLID: 473e64fd-f30b-4765-81a0-62ad96dd167a
origins:
items:
- domainName: sample.s3.amazonaws.com
id: s3Origin
s3OriginConfig:
originAccessIDentity: ""