terragoat

TerraGoat - Vulnerable Terraform Infrastructure

TerraGoat is Bridgecrew’s “Vulnerable by Design” Terraform repository.

TerraGoat is Bridgecrew’s “Vulnerable by Design” Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

Table of Contents

• Introduction
• Getting Started
  • AWS
  • Azure
  • GCP
• Contributing
• Support

Introduction

TerraGoat was built to enable DevSecOps design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like Bridgecrew & Checkov, inline-linters, pre-commit hooks or other code scanning methods.

TerraGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure.

Important notes

• Where to get help: the Bridgecrew Community Slack

Before you proceed please take a not of these warning:

:warning: TerraGoat creates intentionally vulnerable AWS resources into your account. DO NOT deploy TerraGoat in a production environment or alongside any sensitive AWS resources.

Requirements

• Terraform 0.12
• aws cli
• azure cli

To prevent vulnerable infrastructure from arriving to production see: Bridgecrew & checkov, the open source static analysis tool for infrastructure as code.

Getting started

AWS Setup

Installation (AWS)

You can deploy multiple TerraGoat stacks in a single AWS account using the parameter TF_VAR_environment.

Create an S3 Bucket backend to keep Terraform state

export TERRAGOAT_STATE_BUCKET="mydevsecops-bucket"
export TF_VAR_company_name=acme
export TF_VAR_environment=mydevsecops
export TF_VAR_region="us-west-2"

aws s3api create-bucket --bucket $TERRAGOAT_STATE_BUCKET \
    --region $TF_VAR_region --create-bucket-configuration LocationConstraint=$TF_VAR_region

# Enable versioning
aws s3api put-bucket-versioning --bucket $TERRAGOAT_STATE_BUCKET --versioning-configuration Status=Enabled

# Enable encryption
aws s3api put-bucket-encryption --bucket $TERRAGOAT_STATE_BUCKET --server-side-encryption-configuration '{
  "Rules": [
    {
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms"
      }
    }
  ]
}'

Apply TerraGoat (AWS)

cd terraform/aws/
terraform init \
-backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
-backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
-backend-config="region=$TF_VAR_region"

terraform apply

Remove TerraGoat (AWS)

terraform destroy

Creating multiple TerraGoat AWS stacks

cd terraform/aws/
export TERRAGOAT_ENV=$TF_VAR_environment
export TERRAGOAT_STACKS_NUM=5
for i in $(seq 1 $TERRAGOAT_STACKS_NUM)
do
    export TF_VAR_environment=$TERRAGOAT_ENV$i
    terraform init \
    -backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
    -backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
    -backend-config="region=$TF_VAR_region"

    terraform apply -auto-approve
done

Deleting multiple TerraGoat stacks (AWS)

cd terraform/aws/
export TF_VAR_environment = $TERRAGOAT_ENV
for i in $(seq 1 $TERRAGOAT_STACKS_NUM)
do
    export TF_VAR_environment=$TERRAGOAT_ENV$i
    terraform init \
    -backend-config="bucket=$TERRAGOAT_STATE_BUCKET" \
    -backend-config="key=$TF_VAR_company_name-$TF_VAR_environment.tfstate" \
    -backend-config="region=$TF_VAR_region"

    terraform destroy -auto-approve
done

Azure Setup

Installation (Azure)

You can deploy multiple TerraGoat stacks in a single Azure subscription using the parameter TF_VAR_environment.

Create an Azure Storage Account backend to keep Terraform state

export TERRAGOAT_RESOURCE_GROUP="TerraGoatRG"
export TERRAGOAT_STATE_STORAGE_ACCOUNT="mydevsecopssa"
export TERRAGOAT_STATE_CONTAINER="mydevsecops"
export TF_VAR_environment="dev"
export TF_VAR_region="westus"

# Create resource group
az group create --location $TF_VAR_region --name $TERRAGOAT_RESOURCE_GROUP

# Create storage account
az storage account create --name $TERRAGOAT_STATE_STORAGE_ACCOUNT --resource-group $TERRAGOAT_RESOURCE_GROUP --location $TF_VAR_region --sku Standard_LRS --kind StorageV2 --https-only true --encryption-services blob

# Get storage account key
ACCOUNT_KEY=$(az storage account keys list --resource-group $TERRAGOAT_RESOURCE_GROUP --account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT --query [0].value -o tsv)

# Create blob container
az storage container create --name $TERRAGOAT_STATE_CONTAINER --account-name $TERRAGOAT_STATE_STORAGE_ACCOUNT --account-key $ACCOUNT_KEY

Apply TerraGoat (Azure)

cd terraform/azure/
terraform init -reconfigure -backend-config="resource_group_name=$TERRAGOAT_RESOURCE_GROUP" \
    -backend-config "storage_account_name=$TERRAGOAT_STATE_STORAGE_ACCOUNT" \
    -backend-config="container_name=$TERRAGOAT_STATE_CONTAINER" \
    -backend-config "key=$TF_VAR_environment.terraform.tfstate"

terraform apply

Remove TerraGoat (Azure)

terraform destroy

GCP Setup

Installation (GCP)

You can deploy multiple TerraGoat stacks in a single GCP project using the parameter TF_VAR_environment.

Create a GCS backend to keep Terraform state

To use terraform, a Service Account and matching set of credentials are required. If they do not exist, they must be manually created for the relevant project. To create the Service Account:

1. Sign into your GCP project, go to IAM > Service Accounts.
2. Click the CREATE SERVICE ACCOUNT.
3. Give a name to your service account (for example - terragoat) and click CREATE.
4. Grant the Service Account the Project > Editor role and click CONTINUE.
5. Click DONE.

To create the credentials:

1. Sign into your GCP project, go to IAM > Service Accounts and click on the relevant Service Account.
2. Click ADD KEY > Create new key > JSON and click CREATE. This will create a .json file and download it to your computer.

We recommend saving the key with a nicer name than the auto-generated one (i.e. terragoat_credentials.json), and storing the resulting JSON file inside terraform/gcp directory of terragoat. Once the credentials are set up, create the BE configuration as follows:

export TF_VAR_environment="dev"
export TF_TERRAGOAT_STATE_BUCKET=remote-state-bucket-terragoat
export TF_VAR_credentials_path=<PATH_TO_CREDNETIALS_FILE> # example: export TF_VAR_credentials_path=terragoat_credentials.json
export TF_VAR_project=<YOUR_PROJECT_NAME_HERE>

# Create storage bucket
gsutil mb gs://${TF_TERRAGOAT_STATE_BUCKET}

Apply TerraGoat (GCP)

cd terraform/gcp/
terraform init -reconfigure -backend-config="bucket=$TF_TERRAGOAT_STATE_BUCKET" \
    -backend-config "credentials=$TF_VAR_credentials_path" \
    -backend-config "prefix=terragoat/${TF_VAR_environment}"

terraform apply

Remove TerraGoat (GCP)

terraform destroy

Bridgecrew’s IaC herd of goats

• CfnGoat - Vulnerable by design Cloudformation template
• TerraGoat - Vulnerable by design Terraform stack
• CDKGoat - Vulnerable by design CDK application

Contributing

Contribution is welcomed!

We would love to hear about more ideas on how to find vulnerable infrastructure-as-code design patterns.

Support

Bridgecrew builds and maintains TerraGoat to encourage the adoption of policy-as-code.

If you need direct support you can contact us at [email protected].

Existing vulnerabilities (Auto-Generated)

	check_id	file	resource	check_name	guideline
0	CKV_AWS_16	/aws/db-app.tf	aws_db_instance.default	Ensure all data stored in the RDS is securely encrypted at rest	https://docs.bridgecrew.io/docs/general_4
1	CKV_AWS_129	/aws/db-app.tf	aws_db_instance.default	Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled	https://docs.bridgecrew.io/docs/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled
2	CKV_AWS_118	/aws/db-app.tf	aws_db_instance.default	Ensure that enhanced monitoring is enabled for Amazon RDS instances	https://docs.bridgecrew.io/docs/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances
3	CKV_AWS_17	/aws/db-app.tf	aws_db_instance.default	Ensure all data stored in RDS is not publicly accessible	https://docs.bridgecrew.io/docs/public_2
4	CKV_AWS_126	/aws/db-app.tf	aws_instance.db_app	Ensure that detailed monitoring is enabled for EC2 instances	https://docs.bridgecrew.io/docs/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances
5	CKV_AWS_79	/aws/db-app.tf	aws_instance.db_app	Ensure Instance Metadata Service Version 1 is not enabled	https://docs.bridgecrew.io/docs/bc_aws_general_31
6	CKV_AWS_135	/aws/db-app.tf	aws_instance.db_app	Ensure that EC2 is EBS optimized	https://docs.bridgecrew.io/docs/ensure-that-ec2-is-ebs-optimized
7	CKV_AWS_8	/aws/db-app.tf	aws_instance.db_app	Ensure all data stored in the Launch configuration EBS is securely encrypted	https://docs.bridgecrew.io/docs/general_13
8	CKV_AWS_126	/aws/ec2.tf	aws_instance.web_host	Ensure that detailed monitoring is enabled for EC2 instances	https://docs.bridgecrew.io/docs/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances
9	CKV_AWS_79	/aws/ec2.tf	aws_instance.web_host	Ensure Instance Metadata Service Version 1 is not enabled	https://docs.bridgecrew.io/docs/bc_aws_general_31
10	CKV_AWS_135	/aws/ec2.tf	aws_instance.web_host	Ensure that EC2 is EBS optimized	https://docs.bridgecrew.io/docs/ensure-that-ec2-is-ebs-optimized
11	CKV_AWS_8	/aws/ec2.tf	aws_instance.web_host	Ensure all data stored in the Launch configuration EBS is securely encrypted	https://docs.bridgecrew.io/docs/general_13
12	CKV_AWS_46	/aws/ec2.tf	aws_instance.web_host	Ensure no hard-coded secrets exist in EC2 user data	https://docs.bridgecrew.io/docs/bc_aws_secrets_1
13	CKV_AWS_3	/aws/ec2.tf	aws_ebs_volume.web_host_storage	Ensure all data stored in the EBS is securely encrypted	https://docs.bridgecrew.io/docs/general_3-encrypt-eps-volume
14	CKV_AWS_24	/aws/ec2.tf	aws_security_group.web-node	Ensure no security groups allow ingress from 0.0.0.0:0 to port 22	https://docs.bridgecrew.io/docs/networking_1-port-security
15	CKV_AWS_130	/aws/ec2.tf	aws_subnet.web_subnet	Ensure VPC subnets do not assign public IP by default
16	CKV_AWS_130	/aws/ec2.tf	aws_subnet.web_subnet2	Ensure VPC subnets do not assign public IP by default
17	CKV_AWS_21	/aws/ec2.tf	aws_s3_bucket.flowbucket	Ensure all data stored in the S3 bucket have versioning enabled	https://docs.bridgecrew.io/docs/s3_16-enable-versioning
18	CKV_AWS_18	/aws/ec2.tf	aws_s3_bucket.flowbucket	Ensure the S3 bucket has access logging enabled	https://docs.bridgecrew.io/docs/s3_13-enable-logging
19	CKV_AWS_145	/aws/ec2.tf	aws_s3_bucket.flowbucket	Ensure that S3 buckets are encrypted with KMS by default	https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default
20	CKV_AWS_52	/aws/ec2.tf	aws_s3_bucket.flowbucket	Ensure S3 bucket has MFA delete enabled
21	CKV_AWS_19	/aws/ec2.tf	aws_s3_bucket.flowbucket	Ensure all data stored in the S3 bucket is securely encrypted at rest	https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest
22	CKV_AWS_144	/aws/ec2.tf	aws_s3_bucket.flowbucket	Ensure that S3 bucket has cross-region replication enabled	https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled
23	CKV_AWS_51	/aws/ecr.tf	aws_ecr_repository.repository	Ensure ECR Image Tags are immutable	https://docs.bridgecrew.io/docs/bc_aws_general_24
24	CKV_AWS_136	/aws/ecr.tf	aws_ecr_repository.repository	Ensure that ECR repositories are encrypted using KMS	https://docs.bridgecrew.io/docs/ensure-that-ecr-repositories-are-encrypted
25	CKV_AWS_33	/aws/ecr.tf	aws_ecr_repository.repository	Ensure ECR image scanning on push is enabled	https://docs.bridgecrew.io/docs/general_8
26	CKV_AWS_130	/aws/eks.tf	aws_subnet.eks_subnet1	Ensure VPC subnets do not assign public IP by default
27	CKV_AWS_130	/aws/eks.tf	aws_subnet.eks_subnet2	Ensure VPC subnets do not assign public IP by default
28	CKV_AWS_58	/aws/eks.tf	aws_eks_cluster.eks_cluster	Ensure EKS Cluster has Secrets Encryption Enabled	https://docs.bridgecrew.io/docs/bc_aws_kubernetes_3
29	CKV_AWS_38	/aws/eks.tf	aws_eks_cluster.eks_cluster	Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0	https://docs.bridgecrew.io/docs/bc_aws_kubernetes_1
30	CKV_AWS_151	/aws/eks.tf	aws_eks_cluster.eks_cluster	Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) managed in AWS KMS
31	CKV_AWS_39	/aws/eks.tf	aws_eks_cluster.eks_cluster	Ensure Amazon EKS public endpoint disabled	https://docs.bridgecrew.io/docs/bc_aws_kubernetes_2
32	CKV_AWS_37	/aws/eks.tf	aws_eks_cluster.eks_cluster	Ensure Amazon EKS control plane logging enabled for all log types	https://docs.bridgecrew.io/docs/bc_aws_kubernetes_4
33	CKV_AWS_127	/aws/elb.tf	aws_elb.weblb	Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager	https://docs.bridgecrew.io/docs/ensure-that-elastic-load-balancers-uses-ssl-certificates-provided-by-aws-certificate-manager
34	CKV_AWS_92	/aws/elb.tf	aws_elb.weblb	Ensure the ELB has access logging enabled	https://docs.bridgecrew.io/docs/bc_aws_logging_23
35	CKV_AWS_109	/aws/es.tf	aws_iam_policy_document.policy	Ensure IAM policies does not allow permissions management / resource exposure without constraints	https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-permissions-management-resource-exposure-without-constraint
36	CKV_AWS_111	/aws/es.tf	aws_iam_policy_document.policy	Ensure IAM policies does not allow write access without constraints	https://docs.bridgecrew.io/docs/ensure-iam-policies-do-not-allow-write-access-without-constraint
37	CKV_AWS_5	/aws/es.tf	aws_elasticsearch_domain.monitoring-framework	Ensure all data stored in the Elasticsearch is securely encrypted at rest	https://docs.bridgecrew.io/docs/elasticsearch_3-enable-encryptionatrest
38	CKV_AWS_84	/aws/es.tf	aws_elasticsearch_domain.monitoring-framework	Ensure Elasticsearch Domain Logging is enabled	https://docs.bridgecrew.io/docs/elasticsearch_7
39	CKV_AWS_137	/aws/es.tf	aws_elasticsearch_domain.monitoring-framework	Ensure that Elasticsearch is configured inside a VPC	https://docs.bridgecrew.io/docs/ensure-that-elasticsearch-is-configured-inside-a-vpc
40	CKV_AWS_83	/aws/es.tf	aws_elasticsearch_domain.monitoring-framework	Ensure Elasticsearch Domain enforces HTTPS	https://docs.bridgecrew.io/docs/elasticsearch_6
41	CKV_AWS_40	/aws/iam.tf	aws_iam_user_policy.userpolicy	Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)	https://docs.bridgecrew.io/docs/iam_16-iam-policy-privileges-1
42	CKV_AWS_7	/aws/kms.tf	aws_kms_key.logs_key	Ensure rotation for customer created CMKs is enabled	https://docs.bridgecrew.io/docs/logging_8
43	CKV_AWS_45	/aws/lambda.tf	aws_lambda_function.analysis_lambda	Ensure no hard-coded secrets exist in lambda environment	https://docs.bridgecrew.io/docs/bc_aws_secrets_3
44	CKV_AWS_50	/aws/lambda.tf	aws_lambda_function.analysis_lambda	X-ray tracing is enabled for Lambda	https://docs.bridgecrew.io/docs/bc_aws_serverless_4
45	CKV_AWS_115	/aws/lambda.tf	aws_lambda_function.analysis_lambda	Ensure that AWS Lambda function is configured for function-level concurrent execution limit	https://docs.bridgecrew.io/docs/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit
46	CKV_AWS_116	/aws/lambda.tf	aws_lambda_function.analysis_lambda	Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)	https://docs.bridgecrew.io/docs/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq
47	CKV_AWS_117	/aws/lambda.tf	aws_lambda_function.analysis_lambda	Ensure that AWS Lambda function is configured inside a VPC	https://docs.bridgecrew.io/docs/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1
48	CKV_AWS_44	/aws/neptune.tf	aws_neptune_cluster.default	Ensure Neptune storage is securely encrypted	https://docs.bridgecrew.io/docs/general_18
49	CKV_AWS_101	/aws/neptune.tf	aws_neptune_cluster.default	Ensure Neptune logging is enabled	https://docs.bridgecrew.io/docs/bc_aws_logging_24
50	CKV_AWS_41	/aws/providers.tf	aws.plain_text_access_keys_provider	Ensure no hard coded AWS access key and secret key exists in provider	https://docs.bridgecrew.io/docs/bc_aws_secrets_5
51	CKV_AWS_21	/aws/s3.tf	aws_s3_bucket.data	Ensure all data stored in the S3 bucket have versioning enabled	https://docs.bridgecrew.io/docs/s3_16-enable-versioning
52	CKV_AWS_18	/aws/s3.tf	aws_s3_bucket.data	Ensure the S3 bucket has access logging enabled	https://docs.bridgecrew.io/docs/s3_13-enable-logging
53	CKV_AWS_20	/aws/s3.tf	aws_s3_bucket.data	S3 Bucket has an ACL defined which allows public READ access.	https://docs.bridgecrew.io/docs/s3_1-acl-read-permissions-everyone
54	CKV_AWS_145	/aws/s3.tf	aws_s3_bucket.data	Ensure that S3 buckets are encrypted with KMS by default	https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default
55	CKV_AWS_52	/aws/s3.tf	aws_s3_bucket.data	Ensure S3 bucket has MFA delete enabled
56	CKV_AWS_19	/aws/s3.tf	aws_s3_bucket.data	Ensure all data stored in the S3 bucket is securely encrypted at rest	https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest
57	CKV_AWS_144	/aws/s3.tf	aws_s3_bucket.data	Ensure that S3 bucket has cross-region replication enabled	https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled
58	CKV_AWS_21	/aws/s3.tf	aws_s3_bucket.financials	Ensure all data stored in the S3 bucket have versioning enabled	https://docs.bridgecrew.io/docs/s3_16-enable-versioning
59	CKV_AWS_18	/aws/s3.tf	aws_s3_bucket.financials	Ensure the S3 bucket has access logging enabled	https://docs.bridgecrew.io/docs/s3_13-enable-logging
60	CKV_AWS_145	/aws/s3.tf	aws_s3_bucket.financials	Ensure that S3 buckets are encrypted with KMS by default	https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default
61	CKV_AWS_52	/aws/s3.tf	aws_s3_bucket.financials	Ensure S3 bucket has MFA delete enabled
62	CKV_AWS_19	/aws/s3.tf	aws_s3_bucket.financials	Ensure all data stored in the S3 bucket is securely encrypted at rest	https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest
63	CKV_AWS_144	/aws/s3.tf	aws_s3_bucket.financials	Ensure that S3 bucket has cross-region replication enabled	https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled
64	CKV_AWS_18	/aws/s3.tf	aws_s3_bucket.operations	Ensure the S3 bucket has access logging enabled	https://docs.bridgecrew.io/docs/s3_13-enable-logging
65	CKV_AWS_145	/aws/s3.tf	aws_s3_bucket.operations	Ensure that S3 buckets are encrypted with KMS by default	https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default
66	CKV_AWS_52	/aws/s3.tf	aws_s3_bucket.operations	Ensure S3 bucket has MFA delete enabled
67	CKV_AWS_19	/aws/s3.tf	aws_s3_bucket.operations	Ensure all data stored in the S3 bucket is securely encrypted at rest	https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest
68	CKV_AWS_144	/aws/s3.tf	aws_s3_bucket.operations	Ensure that S3 bucket has cross-region replication enabled	https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled
69	CKV_AWS_145	/aws/s3.tf	aws_s3_bucket.data_science	Ensure that S3 buckets are encrypted with KMS by default	https://docs.bridgecrew.io/docs/ensure-that-s3-buckets-are-encrypted-with-kms-by-default
70	CKV_AWS_52	/aws/s3.tf	aws_s3_bucket.data_science	Ensure S3 bucket has MFA delete enabled
71	CKV_AWS_19	/aws/s3.tf	aws_s3_bucket.data_science	Ensure all data stored in the S3 bucket is securely encrypted at rest	https://docs.bridgecrew.io/docs/s3_14-data-encrypted-at-rest
72	CKV_AWS_144	/aws/s3.tf	aws_s3_bucket.data_science	Ensure that S3 bucket has cross-region replication enabled	https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled
73	CKV_AWS_18	/aws/s3.tf	aws_s3_bucket.logs	Ensure the S3 bucket has access logging enabled	https://docs.bridgecrew.io/docs/s3_13-enable-logging
74	CKV_AWS_52	/aws/s3.tf	aws_s3_bucket.logs	Ensure S3 bucket has MFA delete enabled
75	CKV_AWS_144	/aws/s3.tf	aws_s3_bucket.logs	Ensure that S3 bucket has cross-region replication enabled	https://docs.bridgecrew.io/docs/ensure-that-s3-bucket-has-cross-region-replication-enabled
76	CKV_AZURE_6	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure AKS has an API Server Authorized IP Ranges enabled	https://docs.bridgecrew.io/docs/bc_azr_kubernetes_3
77	CKV_AZURE_4	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure AKS logging to Azure Monitoring is Configured	https://docs.bridgecrew.io/docs/bc_azr_kubernetes_1
78	CKV_AZURE_116	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure that AKS uses Azure Policies Add-on	https://docs.bridgecrew.io/docs/ensure-that-aks-uses-azure-policies-add-on
79	CKV_AZURE_5	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure RBAC is enabled on AKS clusters	https://docs.bridgecrew.io/docs/bc_azr_kubernetes_2
80	CKV_AZURE_8	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure Kube Dashboard is disabled	https://docs.bridgecrew.io/docs/bc_azr_kubernetes_5
81	CKV_AZURE_7	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure AKS cluster has Network Policy configured	https://docs.bridgecrew.io/docs/bc_azr_kubernetes_4
82	CKV_AZURE_117	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure that AKS uses disk encryption set	https://docs.bridgecrew.io/docs/ensure-that-aks-uses-disk-encryption-set
83	CKV_AZURE_115	/azure/aks.tf	azurerm_kubernetes_cluster.k8s_cluster	Ensure that AKS enables private clusters	https://docs.bridgecrew.io/docs/ensure-that-aks-enables-private-clusters
84	CKV_AZURE_18	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that ‘HTTP Version’ is the latest if used to run the web app	https://docs.bridgecrew.io/docs/bc_azr_networking_8
85	CKV_AZURE_78	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure FTP deployments are disabled	https://docs.bridgecrew.io/docs/ensure-ftp-deployments-are-disabled
86	CKV_AZURE_63	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that App service enables HTTP logging	https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-http-logging
87	CKV_AZURE_88	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that app services use Azure Files	https://docs.bridgecrew.io/docs/ensure-that-app-services-use-azure-files
88	CKV_AZURE_80	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that ‘Net Framework’ version is the latest, if used as a part of the web app	https://docs.bridgecrew.io/docs/ensure-that-net-framework-version-is-the-latest-if-used-as-a-part-of-the-web-app
89	CKV_AZURE_15	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure web app is using the latest version of TLS encryption	https://docs.bridgecrew.io/docs/bc_azr_networking_6
90	CKV_AZURE_66	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that App service enables failed request tracing	https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-failed-request-tracing
91	CKV_AZURE_71	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that Managed identity provider is enabled for app services	https://docs.bridgecrew.io/docs/ensure-that-managed-identity-provider-is-enabled-for-app-services
92	CKV_AZURE_65	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that App service enables detailed error messages	https://docs.bridgecrew.io/docs/tbdensure-that-app-service-enables-detailed-error-messages
93	CKV_AZURE_16	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure that Register with Azure Active Directory is enabled on App Service	https://docs.bridgecrew.io/docs/bc_azr_iam_1
94	CKV_AZURE_13	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure App Service Authentication is set on Azure App Service	https://docs.bridgecrew.io/docs/bc_azr_general_2
95	CKV_AZURE_17	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure the web app has ‘Client Certificates (Incoming client certificates)’ set	https://docs.bridgecrew.io/docs/bc_azr_networking_7
96	CKV_AZURE_14	/azure/app_service.tf	azurerm_app_service.app-service1	Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service	https://docs.bridgecrew.io/docs/bc_azr_networking_5
97	CKV_AZURE_18	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that ‘HTTP Version’ is the latest if used to run the web app	https://docs.bridgecrew.io/docs/bc_azr_networking_8
98	CKV_AZURE_78	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure FTP deployments are disabled	https://docs.bridgecrew.io/docs/ensure-ftp-deployments-are-disabled
99	CKV_AZURE_63	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that App service enables HTTP logging	https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-http-logging
100	CKV_AZURE_88	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that app services use Azure Files	https://docs.bridgecrew.io/docs/ensure-that-app-services-use-azure-files
101	CKV_AZURE_80	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that ‘Net Framework’ version is the latest, if used as a part of the web app	https://docs.bridgecrew.io/docs/ensure-that-net-framework-version-is-the-latest-if-used-as-a-part-of-the-web-app
102	CKV_AZURE_66	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that App service enables failed request tracing	https://docs.bridgecrew.io/docs/ensure-that-app-service-enables-failed-request-tracing
103	CKV_AZURE_71	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that Managed identity provider is enabled for app services	https://docs.bridgecrew.io/docs/ensure-that-managed-identity-provider-is-enabled-for-app-services
104	CKV_AZURE_65	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that App service enables detailed error messages	https://docs.bridgecrew.io/docs/tbdensure-that-app-service-enables-detailed-error-messages
105	CKV_AZURE_16	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure that Register with Azure Active Directory is enabled on App Service	https://docs.bridgecrew.io/docs/bc_azr_iam_1
106	CKV_AZURE_13	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure App Service Authentication is set on Azure App Service	https://docs.bridgecrew.io/docs/bc_azr_general_2
107	CKV_AZURE_17	/azure/app_service.tf	azurerm_app_service.app-service2	Ensure the web app has ‘Client Certificates (Incoming client certificates)’ set	https://docs.bridgecrew.io/docs/bc_azr_networking_7
108	CKV_AZURE_120	/azure/application_gateway.tf	azurerm_application_gateway.network	Ensure that Application Gateway enables WAF	https://docs.bridgecrew.io/docs/ensure-that-application-gateway-enables-waf
109	CKV_AZURE_1	/azure/instance.tf	azurerm_linux_virtual_machine.linux_machine	Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)	https://docs.bridgecrew.io/docs/bc_azr_networking_1
110	CKV_AZURE_42	/azure/key_vault.tf	azurerm_key_vault.example	Ensure the key vault is recoverable	https://docs.bridgecrew.io/docs/ensure-the-key-vault-is-recoverable
111	CKV_AZURE_110	/azure/key_vault.tf	azurerm_key_vault.example	Ensure that key vault enables purge protection	https://docs.bridgecrew.io/docs/ensure-that-key-vault-enables-purge-protection
112	CKV_AZURE_109	/azure/key_vault.tf	azurerm_key_vault.example	Ensure that key vault allows firewall rules settings	https://docs.bridgecrew.io/docs/ensure-that-key-vault-allows-firewall-rules-settings
113	CKV_AZURE_40	/azure/key_vault.tf	azurerm_key_vault_key.generated	Ensure that the expiration date is set on all keys	https://docs.bridgecrew.io/docs/set-an-expiration-date-on-all-keys
114	CKV_AZURE_112	/azure/key_vault.tf	azurerm_key_vault_key.generated	Ensure that key vault key is backed by HSM	https://docs.bridgecrew.io/docs/ensure-that-key-vault-key-is-backed-by-hsm
115	CKV_AZURE_114	/azure/key_vault.tf	azurerm_key_vault_secret.secret	Ensure that key vault secrets have “content_type” set	https://docs.bridgecrew.io/docs/ensure-that-key-vault-secrets-have-content_type-set
116	CKV_AZURE_41	/azure/key_vault.tf	azurerm_key_vault_secret.secret	Ensure that the expiration date is set on all secrets	https://docs.bridgecrew.io/docs/set-an-expiration-date-on-all-secrets
117	CKV_AZURE_37	/azure/logging.tf	azurerm_monitor_log_profile.logging_profile	Ensure that Activity Log Retention is set 365 days or greater	https://docs.bridgecrew.io/docs/set-activity-log-retention-to-365-days-or-greater
118	CKV_AZURE_38	/azure/logging.tf	azurerm_monitor_log_profile.logging_profile	Ensure audit profile captures all the activities	https://docs.bridgecrew.io/docs/ensure-audit-profile-captures-all-activities
119	CKV_AZURE_10	/azure/networking.tf	azurerm_network_security_group.bad_sg	Ensure that SSH access is restricted from the internet	https://docs.bridgecrew.io/docs/bc_azr_networking_3 </your_project_name_here></path_to_crednetials_file>

README 内容过长，已截取前 64 KB。完整内容请前往 GitHub 仓库查看。