Leveraging Snyk IaC scans, organizations can proactively identify and fix risky policies in their infrastructure as code, be it Terraform, Kubernetes, or CloudFormation.
When used in combination with Solvo, Snyk can generate secure policies in place of the risky ones and help organizations quickly fix misconfigurations and improve security without needing to bring on additional resources or expertise.
Synk Iac Fixes Security Issues in your Code
Snyk IaC provides information about the potential risk from this configuration and general advice for how to fix the problem, and Solvo takes this further by automatically generating the least privileged IAM configuration specific to your environment. Used together, you find and fix issues as you code them, to quickly make the necessary corrections and ensure that it is secure before deploying.
In this article, we’ll go through a workflow combining Solvo’s automatic platform with Snyk IaC to create a customized and secured access from a Lambda function to an S3 bucket.
More and more, organizations are shifting over to using the infrastructure as code model for managing their cloud resource configurations.
Configuring your infrastructure through code allows you to have better version and source control, making it easier to track and replicate conditions from one environment to another. This approach is particularly useful for spinning up AWS S3 buckets that can come in handy for storing your code or other useful bits of data. As a cloud resource, these S3’s are easily shareable with the rest of their team.
But sometimes, these S3’s become a little too shareable. When working quickly, writing a secure IAM policy for a cloud asset (S3, Lambda, EC2 or any other asset) is the last thing that developers think about. In the interest of speed and convenience, it is far from uncommon for a developer to misconfigure the bucket with overly permissive security policies that may put the contents of the bucket at risk of exposure.
Let’s take a look at some policy-based security risks and how we can avoid them.
An improperly configured Lambda example
Below we have a Terraform configuration that sets up an AWS Lambda which puts an image into an S3 bucket. You can also see here the code for the IAM role and security policy.
Which details can we glean from this configuration that should tell us a bit about its contents and level of security?
In our application, the Lambda is currently written to put images of dogs in an S3 bucket. This Lambda has a permission to do that, along with other actions like Put, Get, Delete, Create and List. And many more actions if we consider all the other services in addition to S3.
This happened because of what’s written in lines 52-54. We’re effectively ALLOWing all actions on all resources. These mean admin permissions.
This is far too permissive. The only type of action that should be permitted here is “put”, since anything else is excessive and could lead to data leakage, data corruption, or be used for recon on our assets.
If you know both Terraform and AWS IAM fairly well and you only had to review this one configuration, it might be easy to spot the problem. But, generally there is far more Terraform configuration and the knowledge of configuration details is tough to keep up with, making it unlikely that a developer or security team member will stumble across this risky policy buried deep inside a set of Terraform modules.
Thankfully, there are new tools available that are making the task of finding and fixing these issues a much more manageable lift and helping scale security responsibilities out to all the engineering teams using IaC.
Scanning for Insecure Configurations
Snyk Infrastructure as Code (IaC) is a new IaC testing tool that is capable of scanning Terraform, Kubernetes, and AWS CloudFormation configurations and identifying risky policies across services in AWS, Azure and GCP. This might be something as simple as an asterisk that makes the policy way too permissive, as in our example above. Or possibly a “write” where there should only be a “read”, for example.
By utilizing continuous, automated static testing, Snyk IaC is able to scan Terraform at a scale that makes it effective for organizations for managing their infrastructure as code. If the scan turns up a risky configuration, then Snyk will guide the engineer to a fix, but even better, Solvo can be used with Snyk IaC to automatically generate a secure policy that will mitigate the potential exposure.
Let’s see how it works in practice.
To run the scan, we can use the Snyk CLI to run a `snyk iac test` on our configuration:
Now we see that our policy only allows for “PutObject”, so our dog pics are safe from harm
Once Solvo enforced the policy, we scan the Terraform file again and Snyk IaC shows us that the administrative permissions are all gone:
Combining Integrations for Wider Coverage
Leveraging Snyk IaC scans, organizations can proactively identify and fix risky policies in their infrastructure as code in combination with Solvo. Learn how to quickly fix misconfigurations and improve security without needing to bring on additional resources or expertise.
For more information about how Solvo S3 bucket configurations can help to automatically reduce your cloud infrastructure risk, visit the Solvo website and get started or request a free demo. If you haven’t tried Snyk IaC, you can start using it for free here.