Merge pull request #14 from LerianStudio/fix/documentdb-enable-tls-parameter

fix(security): resolve all 17 Checkov security scan failures

Author: jeffersonrodrigues92

products/midaz/helm.yaml

@@ -200,6 +200,9 @@ Resources:
   # NOTE: Lambda runs outside VPC to access CloudFormation response URL
   # It connects to EKS via public endpoint (EndpointPublicAccess: true)
   HelmDeployerFunction:
+    # checkov:skip=CKV_AWS_116:Deployer Lambda is one-shot during stack creation, DLQ not applicable
+    # checkov:skip=CKV_AWS_117:Deployer Lambda requires internet access for Helm chart deployment to EKS
+    # checkov:skip=CKV_AWS_173:Environment variables contain non-sensitive configuration references (endpoints, ARNs, chart version)
     Type: AWS::Lambda::Function
     Properties:
       FunctionName: !Sub "${ProjectName}-helm-deployer"
@@ -208,6 +211,7 @@ Resources:
       Handler: index.handler
       Timeout: 900
       MemorySize: 1024
+      ReservedConcurrentExecutions: 1
       Role: !GetAtt HelmDeployerRole.Arn
       # No VpcConfig - Lambda runs outside VPC to access internet
       # EKS is accessed via public endpoint

templates/alb-controller.yaml

@@ -44,6 +44,7 @@ Resources:
   # ALB CONTROLLER IAM ROLE (IRSA)
   # =============================================================================
   ALBControllerRole:
+    # checkov:skip=CKV_AWS_111:ALB Controller requires broad write permissions to manage ELBv2 resources across the account as per AWS documentation
     Type: AWS::IAM::Role
     Properties:
       RoleName: !Sub "${ProjectName}-alb-controller-role"
@@ -323,6 +324,9 @@ Resources:
   # LAMBDA FUNCTION FOR ALB CONTROLLER DEPLOYMENT
   # =============================================================================
   ALBControllerDeployerFunction:
+    # checkov:skip=CKV_AWS_116:Deployer Lambda is one-shot during stack creation, DLQ not applicable
+    # checkov:skip=CKV_AWS_117:Deployer Lambda requires internet access for Helm chart deployment to EKS
+    # checkov:skip=CKV_AWS_173:Environment variables contain only non-sensitive configuration (cluster name, VPC ID, region, chart version)
     Type: AWS::Lambda::Function
     Properties:
       FunctionName: !Sub "${ProjectName}-alb-controller-deployer"
@@ -331,6 +335,7 @@ Resources:
       Handler: index.handler
       Timeout: 900
       MemorySize: 1024
+      ReservedConcurrentExecutions: 1
       Role: !GetAtt ALBControllerDeployerRole.Arn
       Environment:
         Variables:

templates/amazonmq.yaml

@@ -101,6 +101,49 @@ Conditions:
     - !Not [!Equals [!Ref AdditionalIngressCIDR3, !Ref AdditionalIngressCIDR2]]
 
 Resources:
+  # =============================================================================
+  # KMS KEY
+  # =============================================================================
+  AmazonMQKMSKey:
+    Type: AWS::KMS::Key
+    Properties:
+      Description: KMS key for AmazonMQ encryption
+      EnableKeyRotation: true
+      KeyPolicy:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: Enable IAM User Permissions
+            Effect: Allow
+            Principal:
+              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
+            Action: kms:*
+            Resource: '*'
+          - Sid: Allow CloudWatch Logs
+            Effect: Allow
+            Principal:
+              Service: !Sub "logs.${AWS::Region}.amazonaws.com"
+            Action:
+              - kms:Encrypt
+              - kms:Decrypt
+              - kms:ReEncrypt*
+              - kms:GenerateDataKey*
+              - kms:DescribeKey
+            Resource: '*'
+            Condition:
+              ArnLike:
+                kms:EncryptionContext:aws:logs:arn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/amazonmq/${ProjectName}"
+      Tags:
+        - Key: Name
+          Value: !Sub "${ProjectName}-amazonmq-kms"
+        - Key: Environment
+          Value: !Ref EnvironmentName
+
+  AmazonMQKMSKeyAlias:
+    Type: AWS::KMS::Alias
+    Properties:
+      AliasName: !Sub "alias/${ProjectName}-amazonmq"
+      TargetKeyId: !Ref AmazonMQKMSKey
+
   # =============================================================================
   # SECRETS
   # =============================================================================
@@ -109,6 +152,7 @@ Resources:
     Properties:
       Name: !Sub "${ProjectName}/amazonmq-password"
       Description: AmazonMQ Admin Password
+      KmsKeyId: !GetAtt AmazonMQKMSKey.Arn
       GenerateSecretString:
         SecretStringTemplate: !Sub '{"username": "${AdminUsername}"}'
         GenerateStringKey: password
@@ -261,6 +305,7 @@ Resources:
     Properties:
       LogGroupName: !Sub "/aws/amazonmq/${ProjectName}"
       RetentionInDays: 30
+      KmsKeyId: !GetAtt AmazonMQKMSKey.Arn
 
   # =============================================================================
   # AMAZONMQ BROKER

templates/documentdb.yaml

@@ -112,6 +112,7 @@ Resources:
     Properties:
       Name: !Sub "${ProjectName}/documentdb-password"
       Description: DocumentDB Master Password
+      KmsKeyId: !GetAtt DocumentDBKMSKey.Arn
       GenerateSecretString:
         SecretStringTemplate: !Sub '{"username": "${MasterUsername}"}'
         GenerateStringKey: password
@@ -235,6 +236,7 @@ Resources:
       Description: Parameter group for Midaz DocumentDB
       Parameters:
         tls: !Ref EnableTLS
+        audit_logs: "enabled"
       Tags:
         - Key: Name
           Value: !Sub "${ProjectName}-documentdb-params"

templates/elasticache.yaml

@@ -78,6 +78,54 @@ Conditions:
     - !Not [!Equals [!Ref AdditionalIngressCIDR3, !Ref AdditionalIngressCIDR2]]
 
 Resources:
+  # =============================================================================
+  # KMS KEY
+  # =============================================================================
+  ElastiCacheKMSKey:
+    Type: AWS::KMS::Key
+    Properties:
+      Description: KMS key for ElastiCache secrets encryption
+      EnableKeyRotation: true
+      KeyPolicy:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: Enable IAM User Permissions
+            Effect: Allow
+            Principal:
+              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
+            Action: kms:*
+            Resource: '*'
+      Tags:
+        - Key: Name
+          Value: !Sub "${ProjectName}-elasticache-kms"
+        - Key: Environment
+          Value: !Ref EnvironmentName
+
+  ElastiCacheKMSKeyAlias:
+    Type: AWS::KMS::Alias
+    Properties:
+      AliasName: !Sub "alias/${ProjectName}-elasticache"
+      TargetKeyId: !Ref ElastiCacheKMSKey
+
+  # =============================================================================
+  # SECRETS
+  # =============================================================================
+  ElastiCacheAuthSecret:
+    Type: AWS::SecretsManager::Secret
+    Properties:
+      Name: !Sub "${ProjectName}/elasticache-auth-token"
+      Description: ElastiCache Auth Token for transit encryption
+      KmsKeyId: !GetAtt ElastiCacheKMSKey.Arn
+      GenerateSecretString:
+        PasswordLength: 64
+        ExcludeCharacters: '"@/\!'
+        ExcludePunctuation: false
+      Tags:
+        - Key: Name
+          Value: !Sub "${ProjectName}-elasticache-auth-secret"
+        - Key: Environment
+          Value: !Ref EnvironmentName
+
   # =============================================================================
   # SECURITY GROUP
   # =============================================================================
@@ -185,7 +233,8 @@ Resources:
       AutomaticFailoverEnabled: true
       MultiAZEnabled: true
       TransitEncryptionEnabled: true
-      TransitEncryptionMode: preferred
+      TransitEncryptionMode: required
+      AuthToken: !Sub "{{resolve:secretsmanager:${ElastiCacheAuthSecret}:SecretString}}"
       AtRestEncryptionEnabled: true
       AutoMinorVersionUpgrade: true
       PreferredMaintenanceWindow: "mon:00:00-mon:03:00"
@@ -212,6 +261,10 @@ Outputs:
     Description: ElastiCache Reader Endpoint
     Value: !GetAtt ElastiCacheReplicationGroup.ReaderEndPoint.Address
 
+  AuthSecretArn:
+    Description: ElastiCache Auth Token Secret ARN
+    Value: !Ref ElastiCacheAuthSecret
+
   SecurityGroupId:
     Description: ElastiCache Security Group ID
     Value: !Ref ElastiCacheSecurityGroup

templates/external-dns.yaml

@@ -156,6 +156,9 @@ Resources:
   # LAMBDA FUNCTION FOR EXTERNAL DNS DEPLOYMENT
   # =============================================================================
   ExternalDNSDeployerFunction:
+    # checkov:skip=CKV_AWS_116:Deployer Lambda is one-shot during stack creation, DLQ not applicable
+    # checkov:skip=CKV_AWS_117:Deployer Lambda requires internet access for Helm chart deployment to EKS
+    # checkov:skip=CKV_AWS_173:Environment variables contain only non-sensitive configuration (cluster name, region, chart version, hosted zone ID)
     Type: AWS::Lambda::Function
     Properties:
       FunctionName: !Sub "${ProjectName}-external-dns-deployer"
@@ -164,6 +167,7 @@ Resources:
       Handler: index.handler
       Timeout: 900
       MemorySize: 1024
+      ReservedConcurrentExecutions: 1
       Role: !GetAtt ExternalDNSDeployerRole.Arn
       Environment:
         Variables:

templates/rds.yaml

@@ -109,15 +109,15 @@ Parameters:
     AllowedValues:
       - "0"
       - "1"
-    Default: "0"
+    Default: "1"
     Description: Force SSL/TLS connections to RDS (1 = enabled, 0 = disabled). Recommended for production with sensitive data.
 
   MultiAZ:
     Type: String
     AllowedValues:
       - "true"
       - "false"
-    Default: "false"
+    Default: "true"
     Description: Enable Multi-AZ deployment for high availability. Recommended for production workloads.
 
   DeletionProtection:
@@ -183,6 +183,7 @@ Resources:
     Properties:
       Name: !Sub "${ProjectName}/rds-master-password"
       Description: RDS Master Password
+      KmsKeyId: !GetAtt RDSKMSKey.Arn
       GenerateSecretString:
         SecretStringTemplate: !Sub '{"username": "${MasterUsername}"}'
         GenerateStringKey: password