checkmarx / kics Goto Github PK

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Home Page: https://kics.io

License: Apache License 2.0

Dockerfile 0.71% Go 24.07% Makefile 0.09% HCL 27.52% Open Policy Agent 44.01% Shell 0.01% CSS 0.08% JavaScript 0.01% HTML 3.49% ANTLR 0.02%

iac infrastructure-as-code security appsec cloudnative hacktoberfest devsecops golang security-tools vulnerability-detection

kics's Introduction

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud native project.

Supported Platforms

Beta Features

In order to run the Databricks, NIFCloud and TencentCloud queries, use the --experimental-queries flag when running KICS.

Getting Started

Setting up and using KICS is super-easy.

First, see how to install and get KICS running.
Then explore KICS output results format and quickly fix the issues detected.

Interested in more advanced stuff?

Deep dive into KICS queries.
Understand how to integrate KICS in your favourite CI/CD pipelines.

See KICS documentation for more details and topics.

How it Works

What makes KICS really powerful and popular is its built-in extensibility. This extensibility is achieved by:

Fully customizable and adjustable heuristics rules, called queries. These can be easily edited, extended and added.
Robust but yet simple architecture, which allows quick addition of support for new Infrastructure as Code solutions.

Community

You're welcome to join our community, talk with us on GitHub discussions or contact KICS core team at [email protected].

KICS Contributors

See our individual contributors in the community page. You're welcome to join them by contributing to KICS.

We also like to thank the following organizations for their ongoing contribution:

Checkmarx
Bedrock Streaming (since v1.4.8)
Dynatrace (since v1.5.1)
Orca Security (since v1.5.10)

KICS Users

KICS is used by various companies and organizations, some are listed below. If you would like to be included here please open a PR.

Keeping Infrastructure as Code Secure!

kics's People

Contributors

Stargazers

Watchers

Forkers

norbinsh cataraujo190 oribendetcx gitter-badger miguelfreitas93 adarweidman trufanovoleh elit-cx felipe-avelar stanislavpolovnyi kaplanlior securestep9 rup3r fjsnogueira b-xiang clix-dev-llc marvel-works askmetoo dsotraining benjaminstokes syllogy laozhudetui alonrosenhek-cx sh1nu11bi luis-david ttousai ferneyra10 rajivraj nx6110a5100 runciblespoon sashka3076 d1pakda5 jack51706 idan-gur magnologan sharadkhare binhan98 briansu2004 moise3 vikas99341 dimaxweb josefranciscosanchezgutierrez tor-0 mukeshpilaniya checkmarxse theoretick s-larbi dusmana smkanji smouelhi pedramjm frediana carolhausercx bhatanimesh02 roock shism2 hecg119 5l1v3r1 ori-argon-dev fr34k8 ekmixon homopatrol smaguilarcx erezyalon gh0st0ne hackerago jbrotsos legly ilanad atdavidpark hackinfinity rezaduty tpbansal ankurmadaan codeshield-test-user aermie cloudkid1273 d3v53c kingindanord alamsz pvtshdw cqr-cryeye-forks kverma517 oren-zohar doughoke nvuillam jynicolas m4rkos paulopontesm cluetrust iberrada marckcloudarch mh-yadava isp1r0 zricethezav bugwrangler anoopupadhyay lipeavelar zhanghuixi standardgalactic

kics's Issues

Engine + CLI must be split from internal integrations

Engine and the CLI must be separate from private repo dependencies

Add aws_cloudformation_stack_notifs for Terraform

Platform

Terraform

Provider

AWS

Description

Enable AWS CloudFormation Stack Notifications

Add Master Authentication is Disabled query for Terraform

Platform

Terraform

Provider

GCP

Description

Kubernetes Engine Clusters must have Master Authentication set to enabled, which means the attribute 'master_auth' must have the subattributes 'username' and 'password' defined and not empty

Add Pod Security Policy is Disabled query for Terraform

Platform

Terraform

Provider

GCP

Description

Kubernetes Clusters must have Pod Security Policy controller enabled, which means there must be a 'pod_security_policy_config' with the 'enabled' attribute equal to true

Add Network Policy is Disabled query for Terraform

Platform

Terraform

Provider

GCP

Description

Kubernetes Engine Clusters must have Network Policy enabled, meaning that the attribute 'network_policy.enabled' must be true and the attribute 'addons_config.network_policy_config.disabled' must be false

Add cloudTrailMultiRegionDisabled query for Terraform

Platform
Terraform

Provider
AWS

Description
Check if the Multi Region is enabled in the CloudTrail

Add IP_Aliasing_is_Disabled query for Terraform

Platform

Terraform

Provider

GCP

Description

Kubernetes Clusters must be created with Alias IP ranges enabled, which means the attribut 'ip_allocation_policy' must be defined and, if defined, the attribute 'networking_mode' must be VPC_NATIVE

Add aws_cloud_formation_without_stack_policy query for Terraform

Platform

Terraform

Provider

AWS

Description

Aws Cloud Formation Stack should have a stack policy in order to protect stack resources from update actions

Add API Gateway Name query for Terraform

Platform

Terraform

Provider

AWS

Description

Check if AWS CloudWatch Logs for APIs is defined

Add Check No Gmail Accounts query for Terraform

Platform

Terrafom

Provider

GCP

Description

Ensure that corporate login credentials are used instead of Gmail accounts.

Add logDuration query for Terraform

Platform

Terraform

Provider

Azure

Description

Ensure server parameter 'log_duration' is set to 'ON' for PostgreSQL Database Server

Add Stackdriver Monitoring is Disabled query for Terraform

Platform

Terraform

Provider

GCP

Description

Kubernetes Engine Clusters must have Stackdriver Monitoring enabled, which means the attribute 'monitoring_service' must be defined and different than 'none'

Add Volume Clusters Encrypted query for Terraform

Platform

Terraform

Provider

AWS

Description

Ensure that AWS EBS clusters are encrypted

Add guardduty_detector_disabled for Terraform

Platform

Terraform

Provider

AWS

Description

This Query confirms that Amazon GuardDuty is Enabled

Add Google storage bucket logging not enabled query for Terraform

Platform

Terraform

Provider

GCP

Description

Google storage bucket with logging not enabled

Update Golang version to 1.15

Need to update to the latest Golang version

Add setup and development instructions to project

The readme.md should be updated to contain all necessary info to setup and run the code

Add CloudStorageBucketWithPublicAccess query for Terraform

Platform

Terraform

Provider

GCP

Description

This query detects if a Cloud Storage Bucket is anonymously or publicly accessible by checking if the member/members field inside the resource 'google_storage_bucket_iam_member' equals/includes 'allUsers' or 'allAuthenticatedUsers'.

Add aws_ebs_encryption_by_default query for Terraform

Platform

Terraform

Provider

AWS

Description

The value must be true or by default (true)

Add logDisconnections query for Terraform

Platform

Terraform

Provider

Azure

Description

Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server

Encryption & Key Management - Add Terraform query (ami not encrypted)

Create new query for Terraform (Aws_Security_Group)

Standardize current queries names

The current queries names should be standardized to make sure each one has a similar naming convention

Update older Terraform queries

Platform

Terraform

Provider

Azure

Description

Rename and change the description and description URL for the following queries:

reme_geo_redundancy_disabled
reme_ssl_enforce_disabled
reme_check_key_expiration_is_set
check_secret_expiration_is_set
storage_account_enable_Https
reme_connection_throttling
reme_log_connections
sql_auditing_retention
mssql_auditing_retention
postgre_sql_logs_enabled
sql_database_disabled_audit
email_alerts_enabled
sql_server_auditing_enabled
mssql_server_auditing_enabled
reme_logRetensionGraterThan90Days
ssl_connection_enabled
reme_security_center_princing_tier

Add Default VPC Exist query for Terraform

Platform

Terraform

Provider

AWS

Description

Avoid creating resources in default VPC

Add SQLDatabaseBackupConfigurationDisabled query for Terraform

Platform

Terraform

Provider

GCP

Description

This query detects Cloud SQL Database instances with backup_configuration disabled. Checks if, within the 'settings' block, the 'backup_configuration' block exists with the 'enable' field equal to 'false'.

Add aws_redshift_cluster query for Terraform

Platform

Terraform

Provider

AWS

Description

This query checks if AWS Redshift Cluster Logging is Disabled

Add SQLDatabaseSSLDisabled query for Terraform

Platform

Terraform

Provider

GCP

Description

This query detects Cloud SQL Database instances with SSL disabled for incoming connections. Checks if, within the 'settings' block, the 'ip_configuration' block exists with the 'require_ssl' field equal to 'false'.

Add test coverage for Windows/Linux

Need to add test to ensure the application has the same expected behavior on both Windows and Linux machines

Add categories structure in queries

Currently the queries are divided in code by "system/provider" (e.g. terraform/aws). A structure grouping the queries per category is recommended to be more readable -> "system/category/provider".

Add docs and mini-site

Add static docs
Add auto-generated static project site

Add log_retention&log_disconnection queries and update log_connection for Terraform

Platform

Terraform

Provider

Azure

Description

Add log_retention&log_disconnection queries - check that these flags are se.
Update log_connection query name, to be in line with the others

Add High severity ports-exposure-queries for Terraform

Platform

Terraform

Provider

Azure

Description

Add the (almost identical) high-severity ports-exposure-related queries to the system.

Add API Gateway Tracing query for Terraform

Platform

Terraform

Provider

AWS

Description

Enable Active Tracing

Add cloudTrail_MultiRegion_Disabled query for Terraform

Platform
Terraform

Provider
AWS

Description
Check if the Multi Region is enabled in the CloudTrail

Repo name and all references replacement in code after renaming

With the impeding change of the repo name, we must ensure all references of the previous name is changed

Add End-to-End testing capabilities

By running our engine against our code samples, we should guarantee that it would never fail, for each PR.

Input:
go run ./cmd/console/main.go -p assets/queries
Output:
Exit status should be 0

In case of failing (exit status 1), we should give some information of the error (showing the log for example)

Add rdp_is_exposed_to_the_internet and ssh_is_exposed_to_the_internet queries for Terraform

Platform

Terraform

Provider

Azure

Description

Port 3389 (Remote Desktop) is exposed to the internet
Port 22 (SSH) is exposed to the internet

Add GKE Basic Authentication is enabled query for Terraform

Platform

Terraform

Provider

GCP

Description

GCP - Google Kubernetes Engine (GKE) Basic Authentication must be disabled, which means the username and password provided in the master_auth block must be empty

Add Check Audit Logging proper configuration query for Terraform

Platform

Terraform

Provider

GCP

Description

Ensure that Cloud Audit Logging is configured properly across all services and all users from a project.

Add DnssecUseRSASHA1 query for Terraform

Platform

Terraform

Provider

GCP

Description

This query checks if, within the 'dnssec_config' block, the 'default_key_specs' block exists with the 'algorithm' field is 'rsasha1' which is bad.

Add ObjectVersioningNotEnabled query for Terraform

Platform

Terraform

Provider

GCP

Description

This query ensures that object versioning is enabled on a Google Storage Bucket by checking if the 'versioning' block exists within the 'google_storage_bucket' resource and with the 'enabled' field equal to 'true'.

Add aws_ebs_volume:snapshot query for Terraform

Platform

Terraform

Provider

AWS)*

Description

The AWS EBS Snapshot Encryption configuration must be enable

Create SimilarityId for results

Description

Create a similarityId for each one of our results, based on:

result file relative path
searchKey field

CircleCI pipelines should be decoupled from existing internal accounts

The current CircleCI pipelines should be separate from the existing internal accounts. Need to evaluate the best solution (eg. Github Actions..)

Add Check Public Access In Cloud SQL Database query for Terraform

Platform

Terraform

Provider

GCP

Description

Support query to check if any Cloud SQL database Instances have public access.

Add Client Certificate is Disabled query for Terraform

Platform

Terraform

Provider

GCP

Description

Kubernetes Clusters must be created with Client Certificate enabled, which means 'master_auth' must have 'client_certificate_config' with the attribute 'issue_client_certificate' equal to true