devsecops
Add intelligent security group scans
It would be a nice to add a feature to this tool where it would scan a CF template for all Security Group resources and check them for common insecure patterns.
ex:
port 3306 -> 0.0.0.0/0 = Grade F
Feature Ideas:
- Generate grade or score based off what the rules template had.
- Generate ATTACK.md for project based off what ports are exposed
- Generate a set of automated pen tests to run against stack once it has been set up.
I second this request. This would be similar to what Stelligent did by extending serverpec to scan their CF templates: https://github.com/stelligent/serverspec-aws-resources.
I'd also suggest expanding to be able to scan NACLs as well as other resources an allow defining compliance policies and scanning against those policies. Ideally, we should be able to scan CF templates for compliance before they get provisioned. If there were an ability to detect changes to AWS resources and bring them back in compliance that would be awesome.
