BOM - AWS Elasticache
- Query id: 54229498-850b-4f78-b3a7-218d24ef2c37
- Query name: BOM - AWS Elasticache
- Platform: Terraform
- Severity: Trace
- Category: Bill Of Materials
- URL: Github
Description¶
A list of Elasticache resources found. Amazon ElastiCache is a fully managed, in-memory caching service supporting flexible, real-time use cases. You can use ElastiCache for caching, which accelerates application and database performance, or as a primary data store for use cases that don't require durability like session stores, gaming leaderboards, streaming, and analytics. ElastiCache is compatible with Redis and Memcached.
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - tf file
resource "aws_elasticache_cluster" "positive1" {
cluster_id = "cluster-example"
engine = "memcached"
node_type = "cache.m4.large"
num_cache_nodes = 2
parameter_group_name = aws_elasticache_parameter_group.default_1
port = 11211
}
resource "aws_elasticache_parameter_group" "default_1" {
name = "cache-params"
family = "memcached1.4"
}
Postitive test num. 2 - tf file
resource "aws_elasticache_cluster" "positive2" {
cluster_id = "cluster-example"
engine = "redis"
node_type = "cache.m4.large"
num_cache_nodes = 1
parameter_group_name = aws_elasticache_parameter_group.default_2
engine_version = "3.2.10"
port = 6379
}
resource "aws_elasticache_parameter_group" "default_2" {
name = "cache-params"
family = "redis3.2"
}
Postitive test num. 3 - tf file
resource "aws_security_group" "sg1" {
name = "sg1"
description = "sg1"
ingress {
from_port = 0
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_security_group" "sg2" {
name = "sg2"
description = "positive3"
ingress {
from_port = 0
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_elasticache_security_group" "positive3" {
name = "positive3"
security_group_names = [
aws_security_group.sg1.name,
aws_security_group.sg2.name,
]
}
resource "aws_elasticache_cluster" "positive3" {
cluster_id = "test-cache"
engine = "redis"
node_type = "cache.m4.large"
port = 6379
num_cache_nodes = 1
parameter_group_name = aws_elasticache_parameter_group.default.id
security_group_names = [aws_elasticache_security_group.positive3.name]
}
Postitive test num. 4 - tf file
resource "aws_security_group" "sg11" {
name = "sg1"
description = "sg11"
ingress {
from_port = 0
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.2.0/0"]
}
}
resource "aws_security_group" "sg22" {
name = "sg22"
description = "positive3"
ingress {
from_port = 0
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.2.0/0"]
}
}
resource "aws_elasticache_security_group" "positive4" {
name = "positive4"
security_group_names = [
aws_security_group.sg11.name,
aws_security_group.sg22.name,
]
}
resource "aws_elasticache_cluster" "positive4" {
cluster_id = "test-cache"
engine = "redis"
node_type = "cache.m4.large"
port = 6379
num_cache_nodes = 1
parameter_group_name = aws_elasticache_parameter_group.default.id
security_group_names = [aws_elasticache_security_group.positive4.name]
}
Postitive test num. 5 - tf file
resource "aws_security_group" "sgg" {
name = "sgg"
description = "sgg"
ingress {
from_port = 0
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.2.0/0"]
}
}
resource "aws_elasticache_cluster" "positive5" {
cluster_id = "test-cache"
engine = "redis"
node_type = "cache.m4.large"
port = 6379
num_cache_nodes = 1
parameter_group_name = aws_elasticache_parameter_group.default.id
security_group_names = [aws_security_group.sgg.name]
}
Postitive test num. 6 - tf file
resource "aws_security_group" "sg6" {
name = "sg6"
description = "sg6"
ingress {
from_port = 0
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_elasticache_cluster" "positive6" {
cluster_id = "test-cache"
engine = "redis"
node_type = "cache.m4.large"
port = 6379
num_cache_nodes = 1
parameter_group_name = aws_elasticache_parameter_group.default.id
security_group_ids = [aws_security_group.sg6.id]
}
Code samples without security vulnerabilities¶
Negative test num. 1 - tf file
module "redis" {
source = "cloudposse/elasticache-redis/aws"
version = "0.40.1"
availability_zones = var.availability_zones
namespace = var.namespace
stage = var.stage
name = var.name
zone_id = var.zone_id
vpc_id = module.vpc.vpc_id
subnets = module.subnets.private_subnet_ids
cluster_size = var.cluster_size
instance_type = var.instance_type
apply_immediately = true
automatic_failover_enabled = false
engine_version = var.engine_version
family = var.family
at_rest_encryption_enabled = var.at_rest_encryption_enabled
transit_encryption_enabled = var.transit_encryption_enabled
security_group_rules = [
{
type = "egress"
from_port = 0
to_port = 65535
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
source_security_group_id = null
description = "Allow all outbound traffic"
},
{
type = "ingress"
from_port = 0
to_port = 65535
protocol = "-1"
cidr_blocks = []
source_security_group_id = module.vpc.vpc_default_security_group_id
description = "Allow all inbound traffic from trusted Security Groups"
},
]
parameter = [
{
name = "notify-keyspace-events"
value = "lK"
}
]
}