mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
77 lines
3.0 KiB
Markdown
77 lines
3.0 KiB
Markdown
# Workflow Reference: IaC Security Scanning
|
|
|
|
## IaC Scanning Pipeline
|
|
|
|
```
|
|
Terraform/IaC Code Change
|
|
│
|
|
▼
|
|
┌──────────────────┐
|
|
│ PR Created │
|
|
└──────┬───────────┘
|
|
│
|
|
├──────────────────────┐
|
|
▼ ▼
|
|
┌──────────────┐ ┌──────────────┐
|
|
│ Checkov │ │ tfsec │
|
|
│ (2500+ rules)│ │ (Terraform) │
|
|
└──────┬───────┘ └──────┬───────┘
|
|
│ │
|
|
└──────────┬─────────┘
|
|
▼
|
|
┌──────────────────┐
|
|
│ SARIF Upload │
|
|
│ to GitHub │
|
|
└──────┬───────────┘
|
|
│
|
|
▼
|
|
┌──────────────────┐
|
|
│ Quality Gate │
|
|
│ (Block on HIGH+) │
|
|
└──────┬───────────┘
|
|
│
|
|
┌─────────┴──────────┐
|
|
▼ ▼
|
|
PASS FAIL
|
|
terraform apply Block merge
|
|
permitted + Fix required
|
|
```
|
|
|
|
## Checkov Command Reference
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `checkov -d ./terraform/` | Scan directory |
|
|
| `checkov -f main.tf` | Scan single file |
|
|
| `checkov -f tfplan.json --framework terraform_plan` | Scan Terraform plan |
|
|
| `checkov --list` | List all available checks |
|
|
| `checkov -d . --check CKV_AWS_18` | Run specific check |
|
|
| `checkov -d . --skip-check CKV_AWS_145` | Skip specific check |
|
|
| `checkov -d . --bc-api-key KEY` | Upload to Bridgecrew |
|
|
| `checkov -d . --create-baseline` | Create baseline file |
|
|
| `checkov -d . --baseline BASELINE` | Scan against baseline |
|
|
| `checkov -d . --external-checks-dir ./custom/` | Use custom checks |
|
|
| `checkov -d . --compact` | Compact output |
|
|
| `checkov -d . --output sarif` | SARIF format output |
|
|
|
|
## Common Misconfigurations by Cloud Provider
|
|
|
|
### AWS Top 10 IaC Misconfigurations
|
|
1. S3 bucket public access enabled (CKV_AWS_18, CKV_AWS_20)
|
|
2. Security group with open ingress 0.0.0.0/0 (CKV_AWS_23)
|
|
3. RDS instance not encrypted (CKV_AWS_16)
|
|
4. CloudTrail not enabled (CKV_AWS_35)
|
|
5. EBS volume not encrypted (CKV_AWS_3)
|
|
6. IAM policy with wildcard actions (CKV_AWS_1)
|
|
7. ALB not using HTTPS (CKV_AWS_2)
|
|
8. CloudWatch logs not encrypted (CKV_AWS_24)
|
|
9. IMDSv2 not required (CKV_AWS_79)
|
|
10. VPC flow logs not enabled (CKV_AWS_9)
|
|
|
|
### Kubernetes Top Misconfigurations
|
|
1. Container running as root (CKV_K8S_6)
|
|
2. Privileged container (CKV_K8S_16)
|
|
3. No resource limits (CKV_K8S_11, CKV_K8S_13)
|
|
4. No readiness/liveness probes (CKV_K8S_9)
|
|
5. hostNetwork enabled (CKV_K8S_19)
|