Apply a security baseline across AWS, Azure and Google Cloud

# AWS, IMDSv2: open a session with PUT, then send the token with every read.
TOKEN=$(curl -sS -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 300")
curl -sS -H "X-aws-ec2-metadata-token: $TOKEN" \
  "http://169.254.169.254/latest/meta-data/iam/security-credentials/"

# Azure: one static header. Microsoft also says to bypass any proxy.
curl -sS -H "Metadata: true" --noproxy "*" \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F"

# Google Cloud: one static header.
curl -sS -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"

# Account guardrails. IMDS and EBS defaults are per Region; S3 BPA is account-wide.
locals {
  regions = toset(["eu-west-1", "us-east-1"]) # every Region you use
}

resource "aws_ec2_instance_metadata_defaults" "imds" {
  for_each                    = local.regions
  region                      = each.key
  http_tokens                 = "required" # new instances launch IMDSv2-only
  http_put_response_hop_limit = 1          # 2 only where containers must reach IMDS
}

resource "aws_ebs_encryption_by_default" "on" {
  for_each = local.regions
  region   = each.key
  enabled  = true
}

resource "aws_s3_account_public_access_block" "all" {
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

# Launch settings override account defaults, so require IMDSv2 here too.
resource "aws_launch_template" "app" {
  name_prefix   = "app-"
  image_id      = var.ami_id
  instance_type = "m7g.large"

  iam_instance_profile {
    name = aws_iam_instance_profile.app.name # role scoped to this app only
  }

  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
    http_put_response_hop_limit = 1
  }
}

# Organization trail, created in the management account (or the CloudTrail delegated administrator).
# The key policy and bucket policy must allow cloudtrail.amazonaws.com; see the CloudTrail guide.
resource "aws_kms_key" "trail" {
  description             = "CloudTrail log files"
  enable_key_rotation     = true
  rotation_period_in_days = 365
  deletion_window_in_days = 30
  policy                  = data.aws_iam_policy_document.trail_key.json
}

resource "aws_cloudtrail" "org" {
  name                       = "org-trail"
  s3_bucket_name             = var.log_archive_bucket # bucket in the log-archive account
  kms_key_id                 = aws_kms_key.trail.arn
  is_organization_trail      = true
  is_multi_region_trail      = true
  enable_log_file_validation = true

  # Advanced selectors replace basic ones, so management events need their own selector.
  advanced_event_selector {
    name = "All management events"
    field_selector {
      field  = "eventCategory"
      equals = ["Management"]
    }
  }

  advanced_event_selector {
    name = "Object reads and writes in the customer-data bucket"
    field_selector {
      field  = "eventCategory"
      equals = ["Data"]
    }
    field_selector {
      field  = "resources.type"
      equals = ["AWS::S3::Object"]
    }
    field_selector {
      field       = "resources.ARN"
      starts_with = ["arn:aws:s3:::acme-customer-data/"]
    }
  }
}

provider "azurerm" {
  features {}
  storage_use_azuread = true # Terraform itself must not need account keys
}

data "azurerm_client_config" "current" {}

resource "azurerm_user_assigned_identity" "app" {
  name                = "id-app-prod"
  location            = azurerm_resource_group.app.location
  resource_group_name = azurerm_resource_group.app.name
}

resource "azurerm_storage_account" "data" {
  name                              = "stappdataprod001"
  resource_group_name               = azurerm_resource_group.app.name
  location                          = azurerm_resource_group.app.location
  account_tier                      = "Standard"
  account_replication_type          = "ZRS"
  allow_nested_items_to_be_public   = false      # the azurerm 4.x default was true
  shared_access_key_enabled         = false      # Entra ID only: no account keys, no key-signed SAS
  public_network_access             = "Disabled" # reach it through a private endpoint
  min_tls_version                   = "TLS1_2"
  infrastructure_encryption_enabled = true
  default_to_oauth_authentication   = true
}

resource "azurerm_role_assignment" "app_blob" {
  scope                = azurerm_storage_account.data.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_user_assigned_identity.app.principal_id
}

resource "azurerm_key_vault" "app" {
  name                          = "kv-app-prod-001"
  location                      = azurerm_resource_group.app.location
  resource_group_name           = azurerm_resource_group.app.name
  tenant_id                     = data.azurerm_client_config.current.tenant_id
  sku_name                      = "standard"
  rbac_authorization_enabled    = true
  purge_protection_enabled      = true
  soft_delete_retention_days    = 90
  public_network_access_enabled = false

  network_acls {
    bypass         = "None"
    default_action = "Deny"
  }
}

resource "azurerm_role_assignment" "app_secrets" {
  scope                = azurerm_key_vault.app.id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = azurerm_user_assigned_identity.app.principal_id
}

# Keep the subscription Activity Log beyond its 90 days.
resource "azurerm_monitor_diagnostic_setting" "activity_log" {
  name                       = "activity-to-security-workspace"
  target_resource_id         = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  log_analytics_workspace_id = var.security_workspace_id

  dynamic "enabled_log" {
    for_each = ["Administrative", "Security", "Policy", "Alert"]
    content {
      category = enabled_log.value
    }
  }
}

# Organization guardrails. Orgs created since 3 May 2024 already enforce some of these.
resource "google_org_policy_policy" "enforce" {
  for_each = toset([
    "iam.managed.disableServiceAccountKeyCreation",
    "iam.managed.disableServiceAccountKeyUpload",
    "iam.automaticIamGrantsForDefaultServiceAccounts",
    "storage.publicAccessPrevention",
    "storage.uniformBucketLevelAccess",
    "compute.skipDefaultNetworkCreation",
    "compute.managed.vmExternalIpAccess",
  ])
  name   = "organizations/${var.org_id}/policies/${each.key}"
  parent = "organizations/${var.org_id}"
  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

resource "google_storage_bucket" "data" {
  project                     = var.project_id
  name                        = "acme-prod-customer-data"
  location                    = "EU"
  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"
}

# Data Access audit logs are off by default for everything except BigQuery.
resource "google_project_iam_audit_config" "storage" {
  project = var.project_id
  service = "storage.googleapis.com"
  audit_log_config { log_type = "DATA_READ" }
  audit_log_config { log_type = "DATA_WRITE" }
}

resource "google_service_account" "app" {
  project    = var.project_id
  account_id = "vm-app-prod"
}

resource "google_compute_instance" "app" {
  project      = var.project_id
  name         = "app-prod-1"
  zone         = "europe-west1-b"
  machine_type = "e2-standard-2"

  boot_disk {
    initialize_params { image = "debian-cloud/debian-12" }
  }
  network_interface {
    subnetwork = var.subnet_id # no access_config block, so no external IP
  }
  service_account {
    email  = google_service_account.app.email # never the default compute SA
    scopes = ["cloud-platform"]               # IAM roles on the SA do the limiting
  }
  shielded_instance_config {
    enable_secure_boot = true
  }
  metadata = {
    enable-oslogin         = "TRUE"
    block-project-ssh-keys = "true"
  }
}

# Passes terraform validate and works on day one. Every resource breaks the baseline.
resource "aws_iam_user" "ci" {
  name = "ci-deployer"
}

resource "aws_iam_access_key" "ci" { # never expires; ends up in a CI secret store
  user = aws_iam_user.ci.name
}

resource "aws_security_group" "app" {
  name = "app"
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # SSH from the whole internet
  }
}

resource "aws_instance" "app" {
  ami                         = var.ami_id
  instance_type               = "m7g.large"
  associate_public_ip_address = true
  vpc_security_group_ids      = [aws_security_group.app.id]
  # No metadata_options: IMDSv1 stays on unless an account default says otherwise
}

resource "aws_s3_bucket" "exports" {
  bucket = "acme-exports"
}

# Omitted arguments default to false, so this turns off all four settings.
resource "aws_s3_bucket_public_access_block" "exports" {
  bucket                  = aws_s3_bucket.exports.id
  block_public_policy     = false # turned off "temporarily" for a partner
  restrict_public_buckets = false
}

# tests/baseline.tftest.hcl: `terraform test` runs it with no AWS credentials.
mock_provider "aws" {
  # Mocked values must still pass provider validation, so give them real shapes.
  mock_resource "aws_kms_key" {
    defaults = { arn = "arn:aws:kms:eu-west-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" }
  }
  mock_data "aws_iam_policy_document" {
    defaults = { json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}" }
  }
}

run "baseline" {
  command = apply

  assert {
    condition     = alltrue([for r in aws_ec2_instance_metadata_defaults.imds : r.http_tokens == "required"])
    error_message = "Every Region must default new instances to IMDSv2"
  }
  assert {
    condition     = aws_launch_template.app.metadata_options[0].http_tokens == "required"
    error_message = "The launch template must not re-enable IMDSv1"
  }
  assert {
    condition     = aws_s3_account_public_access_block.all.restrict_public_buckets
    error_message = "S3 Block Public Access must cover public bucket policies"
  }
  assert {
    condition     = aws_cloudtrail.org.is_multi_region_trail && aws_cloudtrail.org.enable_log_file_validation
    error_message = "The trail must cover every Region and sign its digests"
  }
}

#!/usr/bin/env bash
# Read-only checks. Run with a read-only role in every account, subscription
# and project; repeat the AWS block for each Region you use.
REGION=eu-west-1 ACCOUNT_ID=111122223333 PROJECT=acme-app-prod

# AWS: HttpTokens "required", no instance IDs listed, true, four true flags
aws ec2 get-instance-metadata-defaults --region "$REGION"
aws ec2 describe-instances --region "$REGION" \
  --filters Name=metadata-options.http-tokens,Values=optional \
  --query 'Reservations[].Instances[].InstanceId' --output text
aws ec2 get-ebs-encryption-by-default --region "$REGION"
aws s3control get-public-access-block --account-id "$ACCOUNT_ID"

# Azure: False, False, Disabled (an empty value means the old permissive default)
az storage account list -o table \
  --query "[].{name:name, anonymous:allowBlobPublicAccess, sharedKey:allowSharedKeyAccess, network:publicNetworkAccess}"
for kv in $(az keyvault list --resource-type vault --query "[].name" -o tsv); do
  az keyvault show --name "$kv" -o tsv \
    --query "{name:name, rbac:properties.enableRbacAuthorization, purge:properties.enablePurgeProtection}"
done
az monitor diagnostic-settings subscription list -o table

# Google Cloud: True for each policy, enforced/True buckets, no VM names, no rules
for c in iam.managed.disableServiceAccountKeyCreation storage.publicAccessPrevention \
         compute.skipDefaultNetworkCreation; do
  echo "$c: $(gcloud org-policies describe "$c" --project="$PROJECT" --effective \
    --format='value(spec.rules[0].enforce)')"
done
gcloud storage buckets list --project="$PROJECT" \
  --format="table(name, public_access_prevention, uniform_bucket_level_access)"
gcloud compute instances list --project="$PROJECT" \
  --filter="networkInterfaces[].accessConfigs[].natIP:*" --format="value(name)"
gcloud compute firewall-rules list --project="$PROJECT" \
  --filter="direction=INGRESS AND sourceRanges:0.0.0.0/0 AND disabled=false" \
  --format="table(name, sourceRanges.list())"