软件安全不是安全软件。此处我们关注的主题包括身份验证、Access Control、机密性、加密和权限管理。
encryption_state 参数设置为 disabled。
- name: Set up Kinesis Stream with 10 shards and wait for the stream to become active
community.aws.kinesis_stream:
name: test-stream
shards: 10
wait: yes
wait_timeout: 600
encryption_state: disabled
register: test_stream
- name: create a log_group in CloudWatchLogs
community.aws.cloudwatchlogs_log_group:
log_group_name: test-log-group
tags: { "Name": "test-log-group", "Env" : "QA" }
enable_log_file_validation 参数。
- name: create a single region cloudtrail
community.aws.cloudtrail:
s3_bucket_name: mylogbucket
s3_key_prefix: cloudtrail
region: us-west-2
publicly_accessible 设置为 true。
- name: createdb
community.aws.rds_instance:
db_instance_identifier: test-db
engine: aurora
instance_type: db.t2.small
username: "{{ username }}"
password: "{{ password }}"
cluster_id: test-cluster
publicly_accessible: true
"PSQLSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "VpcId"
},
"GroupDescription": "Enable PSQL access via port 5432 to world",
"SecurityGroupIngress": [
{
"CidrIp": "0.0.0.0/0",
"FromPort": 5432,
"IpProtocol": "tcp",
"ToPort": 5432
}
]
}
PSQLSecurityGroup:
Type: 'AWS::EC2::SecurityGroup'
Properties:
VpcId: !Ref VpcId
GroupDescription: Enable PSQL access via port 5432 to world
SecurityGroupIngress:
- CidrIp: 0.0.0.0/0
FromPort: 5432
IpProtocol: tcp
ToPort: 5432
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"SecKeys": {
"Type": "AWS::IAM::AccessKey",
"Properties": {
"UserName": "Root"
}
}
}
}
AWSTemplateFormatVersion: '2010-09-09'
Resources:
SecKeys:
Type: AWS::IAM::AccessKey
Properties:
UserName: Root
"DbSecurity": {
"Type": "AWS::RDS::DBSecurityGroup",
"Properties": {
"GroupDescription": "Ingress for Amazon RDS security group",
"DBSecurityGroupIngress": {
"CIDRIP": "0.0.0.0/0"
}
}
}
DbSecurity:
Type: 'AWS::RDS::DBSecurityGroup'
Properties:
GroupDescription: Ingress for Amazon RDS security group
DBSecurityGroupIngress:
CIDRIP: 0.0.0.0/0
"Resources": {
"RDCluster": {
"Type": "AWS::Redshift::Cluster",
"Properties": {
"NodeType": "ds2.xlarge",
"ClusterType": "single-node",
"DBName": "rdb",
"PubliclyAccessible": true,
"MasterUsername": "rduser",
"MasterUserPassword": {
"Ref": "MasterUserPassword"
}
}
}
}
Resources:
RDCLuster:
Type: "AWS::Redshift::Cluster"
Properties:
PubliclyAccessible: true
DBName: "rdb"
MasterUsername: "rduser"
MasterUserPassword:
Ref: "MasterUserPassword"
NodeType: "ds2.xlarge"
ClusterType: "single-node"
PublicAccessBlockConfiguration 的 S3 属性下的 BlockPublicPolicy 和 BlockPublicAcls 来禁止此类更新。RestrictPublicBuckets 和 IgnorePublicAcls 的设置。tls 参数将其禁用。
Resources:
DocDBDisabledTLS:
Type: AWS::DocDB::DBClusterParameterGroup
Properties:
Description: docdb cluster parameter group
Name: test
Parameters:
tls: "disabled"
ttl_monitor: "enabled"
{
"Resources": {
"ReplicationGroup": {
"Properties": {
"Engine": "redis",
"EngineVersion": "EngineVersion",
"ReplicasPerNodeGroup": "NumReplicas",
"PreferredMaintenanceWindow": "sat:07:00-sat:08:00",
"AtRestEncryptionEnabled": true,
"CacheParameterGroupName": "CacheParameterGroup",
"SecurityGroupIds": [
"SecurityGroup"
],
"SnapshotRetentionLimit": "SnapshotRetentionLimit",
"CacheNodeType": "CacheNodeType",
"CacheSubnetGroupName": "CacheSubnetGroupName",
"NumNodeGroups": "NumShards",
"SnapshotWindow": "00:00-03:00",
"ReplicationGroupDescription": "AWS::StackName"
},
"UpdatePolicy": {
"UseOnlineResharding": true
},
"DeletionPolicy": "Snapshot",
"UpdateReplacePolicy": "Snapshot",
"Type": "AWS::ElastiCache::ReplicationGroup"
}
}
}
Resources:
ReplicationGroup:
DeletionPolicy: Snapshot
UpdateReplacePolicy: Snapshot
Type: AWS::ElastiCache::ReplicationGroup
Properties:
ReplicationGroupDescription: !Ref 'AWS::StackName'
AtRestEncryptionEnabled: true
CacheNodeType: !Ref CacheNodeType
CacheParameterGroupName: !Ref CacheParameterGroup
CacheSubnetGroupName: !Ref CacheSubnetGroupName
Engine: redis
EngineVersion: !Ref EngineVersion
NumNodeGroups: !Ref NumShards
ReplicasPerNodeGroup: !Ref NumReplicas
PreferredMaintenanceWindow: 'sat:07:00-sat:08:00'
SecurityGroupIds:
- !Ref SecurityGroup
SnapshotRetentionLimit: !Ref SnapshotRetentionLimit
SnapshotWindow: '00:00-03:00'
UpdatePolicy:
UseOnlineResharding: true
{
"Resources": {
"RedShiftParms": {
"Type": "AWS::Redshift::clusterParameterGroup",
"Properties": {
"Description": "parameter group",
"ParameterGroupFamily": "redshift-1.0",
"Parameters": [
{
"ParameterName": "require_ssl",
"ParameterValue": "false"
}
]
}
}
}
}
Resources:
RedShiftclusterParms:
Type: AWS::Redshift::clusterParameterGroup
Properties:
Description: redshift parameter group
ParameterGroupFamily: redshift-1.0
Parameters:
- ParameterName: "require_ssl"
ParameterValue: "false"
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"MyLogGroup": {
"Type": "AWS::Logs::LogGroup",
"Properties": {
"LogGroupName": "Service01LogGroup"
}
}
}
}
AWSTemplateFormatVersion: "2010-09-09"
Resources:
MyLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: Service01LogGroup
"Resources": {
"RedshiftClusterTest": {
"Properties": {
"NodeType": "dc1.large",
"Port": 5439,
"VpcSecurityGroupIds": [
"${RedshiftSecurityGroup}"
],
"ClusterSubnetGroupName": "RedshiftClusterSubnetGroup",
"ClusterType": "single-node"
"MasterUserPassword": "MasterUserPassword",
"MasterUsername": "MasterUsername",
"DBName": "${DatabaseName}",
"IamRoles": ["RawDataBucketAccessRole.Arn"],
"PubliclyAccessible": true
},
"Type": "AWS::Redshift::Cluster"
}
Resources:
RedshiftClusterTest:
Type: AWS::Redshift::Cluster
Properties:
ClusterSubnetGroupName: !Ref RedshiftClusterSubnetGroup
ClusterType: single-node
NumberOfNodes: !Ref RedshiftNodeCount
DBName: !Sub ${DatabaseName}
IamRoles:
- !GetAtt RawDataBucketAccessRole.Arn
MasterUserPassword: !Ref MasterUserPassword
MasterUsername: !Ref MasterUsername
PubliclyAccessible: true
NodeType: dc1.large
Port: 5439
VpcSecurityGroupIds:
- !Sub ${RedshiftSecurityGroup}
<transportSender> 标签不应指定 http，因为不会加密与此 URL 的通信。public_access 参数设置为 container 的 Azure Blob 存储容器。这允许匿名访问该容器的所有 Blob 和数据。
- name: Create container test
azure_rm_storageblob:
resource_group: testGroup
storage_account_name: sa001
container: testContainer
...
public_access: container
...
- name: testFWRule
azure_rm_securitygroup:
resource_group: testRG
name: test
rules:
- name: rule001
priority: 100
direction: Inbound
access: Allow
protocol: "*"
source_port_range: "*"
destination_port_range: "3388-3398"
source_address_prefix: "*"
destination_address_prefix: "*"
- name: rule002
priority: 100
direction: Inbound
access: Allow
protocol: "*"
source_port_range: "*"
destination_port_range: 22
source_address_prefix: "*"
destination_address_prefix: "*"