IaCセキュリティとベストプラクティス

# インストール
brew install tfsec

# スキャン実行
tfsec .

# 出力例
Result #1 CRITICAL Security group rule allows ingress from public internet
  Resource: aws_security_group.web
  File:     main.tf:45-52
  Reason:   Security group rule allows ingress from 0.0.0.0/0 on port 22

  55 |   ingress {
  56 |     from_port   = 22
  57 |     to_port     = 22
  58 |     protocol    = "tcp"
  59 |     cidr_blocks = ["0.0.0.0/0"]    ← SSH を全世界に公開
  60 |   }

# インストール
pip install checkov

# スキャン実行
checkov -d .

# 特定のチェックをスキップ
checkov -d . --skip-check CKV_AWS_18

# .github/workflows/terraform-security.yml
name: Terraform Security

on:
  pull_request:
    paths:
      - 'infrastructure/**'

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: tfsec scan
        uses: aquasecurity/tfsec-action@v1.0.3
        with:
          working_directory: infrastructure/
          soft_fail: false

      - name: checkov scan
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: infrastructure/
          framework: terraform
          quiet: true
          soft_fail: false

# NG: 全ポートを全世界に公開
resource "aws_security_group" "bad" {
  ingress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]    # 全世界からアクセス可能
  }
}

# OK: 必要なポートのみ、必要なソースから
resource "aws_security_group" "good" {
  ingress {
    description     = "HTTP from ALB only"
    from_port       = 80
    to_port         = 80
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]    # ALBからのみ
  }
}

# 全てのS3バケットにパブリックアクセスブロックを設定
resource "aws_s3_bucket_public_access_block" "this" {
  bucket = aws_s3_bucket.this.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# S3
resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# EBS
resource "aws_instance" "web" {
  root_block_device {
    encrypted = true
  }
}

# RDS
resource "aws_db_instance" "this" {
  storage_encrypted = true
}

# NG: パスワードをハードコード
resource "aws_db_instance" "bad" {
  password = "MyP@ssw0rd123"    # コードに直接記述
}

# OK: 変数で注入（CI/CDから渡す）
resource "aws_db_instance" "good" {
  password = var.db_password     # 変数で外部から注入
}

# さらに良い: AWS Secrets Managerを使用
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "myapp/db-password"
}

resource "aws_db_instance" "best" {
  password = data.aws_secretsmanager_secret_version.db_password.secret_string
}

# VPC Flow Logs
resource "aws_flow_log" "vpc" {
  vpc_id          = aws_vpc.this.id
  traffic_type    = "ALL"
  iam_role_arn    = aws_iam_role.flow_log.arn
  log_destination = aws_cloudwatch_log_group.flow_log.arn
}

# S3 アクセスログ
resource "aws_s3_bucket_logging" "this" {
  bucket        = aws_s3_bucket.this.id
  target_bucket = aws_s3_bucket.logs.id
  target_prefix = "s3-access-logs/"
}