# Automated security pipelines

Shreyas Rane's public reference implementation for checking Terraform before cloud changes are deployed.

The example provisions a private S3 data bucket and a separate access-log bucket. A GitHub Actions workflow validates the configuration and checks its security policies. Another job audits the scanner's Python dependencies. The workflow does not contain an AWS deployment step.

## What ran locally

The checked-in reports are actual outputs from local tools, not a simulated GitHub Actions run.

| Check | Recorded result |
| --- | --- |
| Terraform 1.13.5 formatting | Passed |
| Terraform provider-schema validation | Could not complete in this container |
| Hardened S3 configuration, selected Checkov policies | 18 passed, 0 failed, 1 documented exception |
| Deliberately incomplete S3 fixture | 7 expected policy failures detected |
| pip-audit of the security-tool dependencies | Blocked, 2 packages flagged |

Terraform downloaded and checksum-verified AWS provider 6.20.0, but the local runtime prevented the provider from opening its required Unix socket. Provider-schema validation therefore remains unverified. The GitHub workflow includes the real `terraform validate` command as a required job step.

The recorded dependency audit flagged `asteval==1.0.6` and `ecdsa==0.19.2` in the resolved Checkov toolchain. The JSON report retains the advisory details. The website export deduplicates repeated advisory IDs. Package advisories describe potential issues in dependencies, not proof that this use of Checkov is exploitable.

The dependency job is deliberately left blocking. Before adopting this workflow, review updated Checkov releases and regenerate the audit. Do not add a blanket exception just to turn the check green. The `asteval` records list a fixed release. The `ecdsa` record does not list one in this snapshot.

## Run the checks

Install Terraform 1.13.5 and Python 3.12. From this directory:

```bash
python -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements-tools.txt
terraform fmt -check -recursive
terraform -chdir=infra init -backend=false -input=false -lockfile=readonly
terraform -chdir=infra validate -json > reports/terraform-validation.json
python scripts/verify_fixtures.py
pip-audit -r requirements-tools.txt --strict --progress-spinner off -f json -o reports/tool-vulnerabilities.json
```

The final command returns a nonzero exit code while advisories remain. After reviewing the reports, export the website data with:

```bash
python scripts/build_demo.py
```

`verify_fixtures.py` fails if the hardened configuration fails a selected policy or the weak fixture stops producing the expected findings. It also rejects parser errors and empty scans. The fixture is scanned as text and is never planned or applied.

## How the S3 configuration is scoped

Both buckets block public access and disable ACLs through `BucketOwnerEnforced`. Versioning is enabled. Explicit SSE-S3 encryption is configured, including on the log bucket. TLS is required by the bucket policies. Log delivery is limited to the source bucket and source AWS account.

S3 already encrypts new objects by default. Omitting an encryption block is not presented as an unencrypted-bucket finding in this example. The scanner's selected encryption check also recognizes the AWS default.

The log destination is exempted only from the access-logging check. Pointing it back to itself would produce a recursive log stream. S3 server access logging is best effort and is not a substitute for a complete audit trail. The example does not configure CloudTrail data events.

The policy list is explicit in `policy-checks.txt`. It is a narrow S3 baseline, not a claim that every Checkov policy passed. TLS policies are present in the configuration, but the selected checks should not be treated as a complete IAM-policy proof.

## Put the workflow in a repository

Copy this directory into its own Git repository with `.github/workflows/security.yml` at the repository root. The workflow runs on pull requests and on pushes to `main`, with a weekly audit for newly published advisories. Set the three job checks as required branch checks if they should block merging.

GitHub Actions uses read-only repository permission. The checkout does not persist credentials. No cloud keys or `id-token: write` permission are needed for these checks. The action commit pins were resolved from the official repositories' release tags. Dependabot proposes action, Python and provider updates for review.

Terraform initialization downloads the pinned provider but does not contact AWS. Validation does not check whether the caller can deploy, whether an account-level policy changes the result, or whether logs arrive. Those need an authorized test account and a separate deployment review. No AWS resources were created for this example.

The dependency audit resolves transitive packages from the pinned top-level tool versions. The entire Python dependency tree is not locked. Results can change between runs, which is why each output is a recorded report rather than a permanent clean-status badge. Review the toolchain and generate a hash-locked environment before adopting it for a production workflow.

## Files

| Path | Purpose |
| --- | --- |
| `infra/` | AWS Terraform configuration and provider checksum lock |
| `fixtures/insecure/` | Deliberately weak configuration used only for scanner tests |
| `policy-checks.txt` | Selected Checkov policy IDs |
| `.github/workflows/security.yml` | Validation, policy and dependency-audit jobs |
| `scripts/verify_fixtures.py` | Checks the actual scanner's pass/fail behavior |
| `scripts/build_demo.py` | Derives the website data from reports |
| `reports/` | Recorded local tool outputs |
| `demo.json` | Before/after evidence for the portfolio explorer |

## Primary references

- AWS S3 logging permissions: https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html
- AWS default encryption: https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html
- AWS provider 6.20.0: https://registry.terraform.io/providers/hashicorp/aws/6.20.0/docs/resources/s3_bucket
- Terraform JSON validation output: https://developer.hashicorp.com/terraform/cli/commands/validate
- Checkov policy index: https://www.checkov.io/5.Policy%20Index/terraform.html
- pip-audit usage and exit codes: https://github.com/pypa/pip-audit
- GitHub workflow security: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions