Security Posture

secure-cloud-infrastructure · commit 7cc3a18 · generated 2026-10-18 23:03 UTC · workflow run

Passing

IaC misconfiguration scan

Checkov

414 passed, 0 failed, 14 accepted with justification

Passing

Policy as code

OPA / Conftest

525 checks passed, 0 violations, 0 warnings

Passing

Policy unit tests

opa test

17/17 tests passed

Passing

Secret scanning

Gitleaks

No secrets found in git history

Passing

Container image vulnerabilities (courier-dispatch:scan)

Trivy

0 fixable critical/high · 0 critical, 44 high, 63 medium, 62 low total

Passing

Software bill of materials

Syft (SPDX)

128 packages inventoried

Findings

Checkov: 414 passed, 0 failed, 14 accepted with justification

Result	Check	Resource	Detail
ACCEPTED	CKV_AWS_260	module.app.aws_vpc_security_group_ingress_rule.alb_http_redirect	Port 80 only serves a 301 redirect to HTTPS (enforced by the http_redirect listener and the conftest listener policy).
ACCEPTED	CKV_AWS_394	module.network.aws_availability_zones.available	Only the first az_count zones (sorted by name) are used, so a newly added zone never changes the selection.
ACCEPTED	CKV_AWS_109	module.baseline.aws_iam_policy_document.kms	The account root statement is the AWS recommended default so the key can never become unmanageable.
ACCEPTED	CKV_AWS_111	module.baseline.aws_iam_policy_document.kms	This is a KMS key policy; "*" as resource means "this key" and service statements are scoped by conditions.
ACCEPTED	CKV_AWS_356	module.baseline.aws_iam_policy_document.kms	Same as above: key policies must use "*" as the resource.
ACCEPTED	CKV2_AWS_62	aws_s3_bucket.state	No consumer for object events on the state bucket.
ACCEPTED	CKV2_AWS_62	module.baseline.aws_s3_bucket.logs	No consumer for object events on the archive; alerting runs off CloudTrail and GuardDuty.
ACCEPTED	CKV2_AWS_3	module.baseline.aws_guardduty_detector.this	Single account deployment with no AWS Organization; the detector is enabled in the deployment region.
ACCEPTED	CKV_AWS_18	aws_s3_bucket.state	State bucket access is captured by CloudTrail; a separate access log bucket adds cost without new signal.
ACCEPTED	CKV_AWS_18	module.baseline.aws_s3_bucket.logs	This is the log archive itself; logging it into itself would loop. Access is captured by CloudTrail.
ACCEPTED	CKV2_AWS_64	aws_kms_key.state	Default key policy (account root) is intended for this single purpose key.
ACCEPTED	CKV_AWS_144	aws_s3_bucket.state	State is versioned; cross region replication is an accepted cost tradeoff (docs/risk-register.md).
ACCEPTED	CKV_AWS_144	module.baseline.aws_s3_bucket.logs	Cross region replication doubles storage cost; accepted risk for this environment, see docs/risk-register.md.
ACCEPTED	CKV2_AWS_61	aws_s3_bucket.state	Noncurrent state versions are kept indefinitely on purpose for recovery.

opa test: 17/17 tests passed

Result	Test
PASS	test_ecs_public_ip_denied
PASS	test_weak_tls_policy_denied
PASS	test_unencrypted_log_group_denied
PASS	test_partial_public_access_block_denied
PASS	test_mutable_unscanned_ecr_denied
PASS	test_bucket_without_public_access_block_denied
PASS	test_aes256_bucket_encryption_denied
PASS	test_public_unencrypted_rds_denied
PASS	test_kms_without_rotation_denied
PASS	test_compliant_rds_allowed
PASS	test_inline_rdp_open_to_world_denied
PASS	test_ssh_open_to_world_denied
PASS	test_https_open_to_world_allowed
PASS	test_wildcard_iam_warns
PASS	test_single_region_trail_denied
PASS	test_public_subnet_auto_ip_denied
PASS	test_http_listener_forwarding_denied

Trivy: 0 fixable critical/high · 0 critical, 44 high, 63 medium, 62 low total

Severity	ID	Package	Installed	Fixed in
HIGH	CVE-2025-69720	libncursesw6	6.5+20250216-2	no fix yet
HIGH	CVE-2025-69720	libtinfo6	6.5+20250216-2	no fix yet
HIGH	CVE-2025-69720	ncurses-base	6.5+20250216-2	no fix yet
HIGH	CVE-2025-69720	ncurses-bin	6.5+20250216-2	no fix yet
HIGH	CVE-2026-16742	libsystemd0	257.13-1~deb13u1	no fix yet
HIGH	CVE-2026-16742	libudev1	257.13-1~deb13u1	no fix yet
HIGH	CVE-2026-54369	libacl1	2.3.2-2+b1	no fix yet
HIGH	CVE-2026-76642	bsdutils	1:2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	libblkid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	liblastlog2-2	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	libmount1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	libsmartcols1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	libuuid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	login	1:4.16.0-2+really2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	mount	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-76642	util-linux	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	bsdutils	1:2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	libblkid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	liblastlog2-2	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	libmount1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	libsmartcols1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	libuuid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	login	1:4.16.0-2+really2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	mount	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78408	util-linux	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	bsdutils	1:2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	libblkid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	liblastlog2-2	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	libmount1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	libsmartcols1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	libuuid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	login	1:4.16.0-2+really2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	mount	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78409	util-linux	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	bsdutils	1:2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	libblkid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	liblastlog2-2	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	libmount1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	libsmartcols1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	libuuid1	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	login	1:4.16.0-2+really2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	mount	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-78410	util-linux	2.41.5-0+deb13u1	no fix yet
HIGH	CVE-2026-9538	perl-base	5.40.1-6+deb13u1	no fix yet

Controls implemented

Encryption at rest	KMS CMK with rotation for S3, RDS, logs, ECR, SNS, Secrets Manager
Encryption in transit	TLS 1.2+ listener policy, HTTP redirect, rds.force_ssl, TLS only bucket policy
Network isolation	Three tier VPC, data subnets with no internet route, SG to SG rules, NACLs
Edge protection	AWS WAF managed rules, Log4j and SQLi rules, per IP rate limiting
Least privilege	Separate task execution and task roles, secrets scoped by ARN, no ECS exec
Workload hardening	Non root user, read only root filesystem, all capabilities dropped
Audit logging	Multi region CloudTrail with validation, VPC flow logs, WAF and ALB logs
Threat detection	GuardDuty (S3 + Fargate runtime), Security Hub CIS v3 and AWS FSBP
Supply chain	Images pinned by digest, signed with Sigstore cosign, SBOM attested
Secrets	DB credentials generated and rotated by Secrets Manager, gitleaks on every push