saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/implementing-infrastructure-as-code-security-scanning/references/workflows.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

3.0 KiB
Raw Blame History

Workflow Reference: IaC Security Scanning

IaC Scanning Pipeline

Terraform/IaC Code Change
       │
       ▼
┌──────────────────┐
│ PR Created       │
└──────┬───────────┘
       │
       ├──────────────────────┐
       ▼                      ▼
┌──────────────┐    ┌──────────────┐
│ Checkov      │    │ tfsec        │
│ (2500+ rules)│    │ (Terraform)  │
└──────┬───────┘    └──────┬───────┘
       │                    │
       └──────────┬─────────┘
                  ▼
       ┌──────────────────┐
       │ SARIF Upload     │
       │ to GitHub        │
       └──────┬───────────┘
              │
              ▼
       ┌──────────────────┐
       │ Quality Gate     │
       │ (Block on HIGH+) │
       └──────┬───────────┘
              │
    ┌─────────┴──────────┐
    ▼                    ▼
 PASS                  FAIL
 terraform apply      Block merge
 permitted            + Fix required

Checkov Command Reference

Command Purpose
checkov -d ./terraform/ Scan directory
checkov -f main.tf Scan single file
checkov -f tfplan.json --framework terraform_plan Scan Terraform plan
checkov --list List all available checks
checkov -d . --check CKV_AWS_18 Run specific check
checkov -d . --skip-check CKV_AWS_145 Skip specific check
checkov -d . --bc-api-key KEY Upload to Bridgecrew
checkov -d . --create-baseline Create baseline file
checkov -d . --baseline BASELINE Scan against baseline
checkov -d . --external-checks-dir ./custom/ Use custom checks
checkov -d . --compact Compact output
checkov -d . --output sarif SARIF format output

Common Misconfigurations by Cloud Provider

AWS Top 10 IaC Misconfigurations

  1. S3 bucket public access enabled (CKV_AWS_18, CKV_AWS_20)
  2. Security group with open ingress 0.0.0.0/0 (CKV_AWS_23)
  3. RDS instance not encrypted (CKV_AWS_16)
  4. CloudTrail not enabled (CKV_AWS_35)
  5. EBS volume not encrypted (CKV_AWS_3)
  6. IAM policy with wildcard actions (CKV_AWS_1)
  7. ALB not using HTTPS (CKV_AWS_2)
  8. CloudWatch logs not encrypted (CKV_AWS_24)
  9. IMDSv2 not required (CKV_AWS_79)
  10. VPC flow logs not enabled (CKV_AWS_9)

Kubernetes Top Misconfigurations

  1. Container running as root (CKV_K8S_6)
  2. Privileged container (CKV_K8S_16)
  3. No resource limits (CKV_K8S_11, CKV_K8S_13)
  4. No readiness/liveness probes (CKV_K8S_9)
  5. hostNetwork enabled (CKV_K8S_19)