Beta - CVM Instance Has Public IP
- Query id: a74b4602-a62c-4a02-956a-e19f86ea24b5
- Query name: Beta - CVM Instance Has Public IP
- Platform: Terraform
- Severity: High
- Category: Networking and Firewall
- CWE: 200
- URL: Github
Description¶
CVM Instance should not have a public IP address.
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - tf file
resource "tencentcloud_instance" "cvm_postpaid" {
instance_name = "cvm_postpaid"
availability_zone = "ap-guangzhou-7"
image_id = "img-9qrfy1xt"
instance_type = "POSTPAID_BY_HOUR"
system_disk_type = "CLOUD_PREMIUM"
system_disk_size = 50
hostname = "root"
project_id = 0
vpc_id = "vpc-axrsmmrv"
subnet_id = "subnet-861wd75e"
internet_max_bandwidth_out = 100
allocate_public_ip = true
data_disks {
data_disk_type = "CLOUD_PREMIUM"
data_disk_size = 50
encrypt = false
}
tags = {
tagKey = "tagValue"
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - tf file
resource "tencentcloud_instance" "cvm_postpaid" {
instance_name = "cvm_postpaid"
availability_zone = "ap-guangzhou-7"
image_id = "img-9qrfy1xt"
instance_type = "POSTPAID_BY_HOUR"
system_disk_type = "CLOUD_PREMIUM"
system_disk_size = 50
hostname = "root"
project_id = 0
vpc_id = "vpc-axrsmmrv"
subnet_id = "subnet-861wd75e"
data_disks {
data_disk_type = "CLOUD_PREMIUM"
data_disk_size = 50
encrypt = false
}
tags = {
tagKey = "tagValue"
}
}
Negative test num. 2 - tf file
resource "tencentcloud_instance" "cvm_postpaid" {
instance_name = "cvm_postpaid"
availability_zone = "ap-guangzhou-7"
image_id = "img-9qrfy1xt"
instance_type = "POSTPAID_BY_HOUR"
system_disk_type = "CLOUD_PREMIUM"
system_disk_size = 50
hostname = "root"
project_id = 0
vpc_id = "vpc-axrsmmrv"
subnet_id = "subnet-861wd75e"
allocate_public_ip = false
data_disks {
data_disk_type = "CLOUD_PREMIUM"
data_disk_size = 50
encrypt = false
}
tags = {
tagKey = "tagValue"
}
}