Add support for Autoscaling Launch Templates

avd_docs/aws/autoscaling/AVD-AWS-0129/CloudFormation.md

@@ -0,0 +1,32 @@
+
+Remove sensitive data from the EC2 instance user-data
+
+```yaml
+---
+Resources:
+  InstanceProfile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      InstanceProfileName: MyIamInstanceProfile
+      Path: "/"
+      Roles:
+      - MyAdminRole
+  GoodExample:
+    Type: AWS::EC2::LaunchTemplate
+    Properties:
+      LaunchTemplateName: MyLaunchTemplate
+      LaunchTemplateData:
+        IamInstanceProfile:
+          Arn: !GetAtt
+            - MyIamInstanceProfile
+            - Arn
+        DisableApiTermination: true
+        ImageId: ami-04d5cc9b88example
+        UserData: export SSM_PATH=/database/creds
+        InstanceType: t2.micro
+        KeyName: MyKeyPair
+        MetadataOptions:
+          - HttpTokens: required
+        SecurityGroupIds:
+          - sg-083cd3bfb8example
+```

avd_docs/aws/autoscaling/AVD-AWS-0129/Terraform.md

@@ -0,0 +1,25 @@
+
+Remove sensitive data from the EC2 instance user-data
+
+```hcl
+resource "aws_iam_instance_profile" "good_example" {
+  // ...
+}
+
+resource "aws_launch_template" "good_example" {
+  image_id           = "ami-12345667"
+  instance_type = "t2.small"
+
+  iam_instance_profile {
+    aws_iam_instance_profile.good_profile.arn
+  }
+
+  user_data = <<EOF
+  export GREETING=hello
+  EOF
+}
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#user_data
+

avd_docs/aws/autoscaling/AVD-AWS-0129/docs.md

@@ -0,0 +1,14 @@
+
+### User data for EC2 instances created with launch templates must not contain sensitive AWS keys
+
+Launch template instance data is used to pass start up information into the EC2 instance. This userdata must not contain access key credentials. Instead use an IAM Instance Profile assigned to the instance to grant access to other AWS Services.
+
+### Impact
+User data is visible through the AWS Management console
+
+<!-- DO NOT CHANGE -->
+{{ remediationActions }}
+
+### Links
+- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-add-user-data.html
+

avd_docs/aws/autoscaling/AVD-AWS-0130/CloudFormation.md

@@ -0,0 +1,35 @@
+
+Enable IMDSv2 in the MetadatOptions
+
+```yaml
+---
+Resources:
+  InstanceProfile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      InstanceProfileName: MyIamInstanceProfile
+      Path: "/"
+      Roles:
+      - MyAdminRole
+  GoodExample:
+    Type: AWS::EC2::LaunchTemplate
+    Properties:
+      LaunchTemplateName: MyLaunchTemplate
+      LaunchTemplateData:
+        IamInstanceProfile:
+          Arn: !GetAtt
+            - MyIamInstanceProfile
+            - Arn
+        DisableApiTermination: true
+        ImageId: ami-04d5cc9b88example
+        UserData: export SSM_PATH=/database/creds
+        InstanceType: t2.micro
+        KeyName: MyKeyPair
+        MetadataOptions:
+          - HttpTokens: required
+        SecurityGroupIds:
+          - sg-083cd3bfb8example
+```
+
+#### Remediation Links
+- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-launchtemplatedata-metadataoptions.html

avd_docs/aws/autoscaling/AVD-AWS-0130/Terraform.md

@@ -0,0 +1,16 @@
+
+Enable HTTP token requirement for IMDS
+
+```hcl
+resource "aws_launch_template" "good_example" {
+  image_id           = "ami-005e54dee72cc1d00"
+  instance_type      = "t2.micro"
+  metadata_options   {
+    http_tokens = "required"
+  }
+}
+```
+
+#### Remediation Links
+ - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options
+

avd_docs/aws/autoscaling/AVD-AWS-0130/docs.md

@@ -0,0 +1,18 @@
+
+### AW instances should activate session tokens for Instance Metadata Service.
+
+
+IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.
+By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional. 
+To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.
+
+
+### Impact
+Instance metadata service can be interacted with freely
+
+<!-- DO NOT CHANGE -->
+{{ remediationActions }}
+
+### Links
+- https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service
+

provider/aws/autoscaling/autoscaling.go

@@ -1,10 +1,14 @@
 package autoscaling
 
-import "github.com/aquasecurity/defsec/types"
+import (
+	"github.com/aquasecurity/defsec/provider/aws/ec2"
+	"github.com/aquasecurity/defsec/types"
+)
 
 type Autoscaling struct {
 	types.Metadata
 	LaunchConfigurations []LaunchConfiguration
+	LaunchTemplates      []LaunchTemplate
 }
 
 type LaunchConfiguration struct {
@@ -13,9 +17,15 @@ type LaunchConfiguration struct {
 	AssociatePublicIP types.BoolValue
 	RootBlockDevice   *BlockDevice
 	EBSBlockDevices   []BlockDevice
+	MetadataOptions   ec2.MetadataOptions
 	UserData          types.StringValue
 }
 
+type LaunchTemplate struct {
+	types.Metadata
+	ec2.Instance
+}
+
 type BlockDevice struct {
 	types.Metadata
 	Encrypted types.BoolValue
@@ -29,6 +39,14 @@ func (d *BlockDevice) GetRawValue() interface{} {
 	return nil
 }
 
+func (i *LaunchConfiguration) RequiresIMDSToken() bool {
+	return i.MetadataOptions.HttpTokens.EqualTo("required")
+}
+
+func (i *LaunchConfiguration) HasHTTPEndpointDisabled() bool {
+	return i.MetadataOptions.HttpEndpoint.EqualTo("disabled")
+}
+
 func (d *LaunchConfiguration) GetMetadata() *types.Metadata {
 	return &d.Metadata
 }
@@ -37,6 +55,14 @@ func (d *LaunchConfiguration) GetRawValue() interface{} {
 	return nil
 }
 
+func (d *LaunchTemplate) GetMetadata() *types.Metadata {
+	return &d.Metadata
+}
+
+func (d *LaunchTemplate) GetRawValue() interface{} {
+	return nil
+}
+
 func (a *Autoscaling) GetMetadata() *types.Metadata {
 	return &a.Metadata
 }

rules/aws/autoscaling/enforce_http_token_imds.cf.go

@@ -0,0 +1,66 @@
+package autoscaling
+
+var cloudformationEnforceHttpTokenImdsGoodExamples = []string{
+	`---
+Resources:
+  InstanceProfile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      InstanceProfileName: MyIamInstanceProfile
+      Path: "/"
+      Roles:
+      - MyAdminRole
+  GoodExample:
+    Type: AWS::EC2::LaunchTemplate
+    Properties:
+      LaunchTemplateName: MyLaunchTemplate
+      LaunchTemplateData:
+        IamInstanceProfile:
+          Arn: !GetAtt
+            - MyIamInstanceProfile
+            - Arn
+        DisableApiTermination: true
+        ImageId: ami-04d5cc9b88example
+        UserData: export SSM_PATH=/database/creds
+        InstanceType: t2.micro
+        KeyName: MyKeyPair
+        MetadataOptions:
+          - HttpTokens: required
+        SecurityGroupIds:
+          - sg-083cd3bfb8example
+ `,
+}
+
+var cloudformationEnforceHttpTokenImdsBadExamples = []string{
+	`---
+Resources:
+  InstanceProfile:
+	Type: AWS::IAM::InstanceProfile
+	Properties:
+		InstanceProfileName: MyIamInstanceProfile
+		Path: "/"
+		Roles:
+		- MyAdminRole
+  BadExample:
+    Type: AWS::EC2::LaunchTemplate
+    Properties:
+      LaunchTemplateName: MyLaunchTemplate
+      LaunchTemplateData:
+        IamInstanceProfile:
+          Arn: !GetAtt
+            - MyIamInstanceProfile
+            - Arn
+        DisableApiTermination: true
+        ImageId: ami-04d5cc9b88example
+        InstanceType: t2.micro
+        KeyName: MyKeyPair
+        MetadataOptions:
+          - HttpTokens: optional
+        SecurityGroupIds:
+          - sg-083cd3bfb8example
+ `,
+}
+
+var cloudformationEnforceHttpTokenImdsLinks = []string{}
+
+var cloudformationEnforceHttpTokenImdsRemediationMarkdown = ``

rules/aws/autoscaling/enforce_http_token_imds.go

@@ -0,0 +1,66 @@
+package autoscaling
+
+import (
+	"github.com/aquasecurity/defsec/provider"
+	"github.com/aquasecurity/defsec/rules"
+	"github.com/aquasecurity/defsec/severity"
+	"github.com/aquasecurity/defsec/state"
+)
+
+var CheckIMDSAccessRequiresToken = rules.Register(
+	rules.Rule{
+		AVDID:      "AVD-AWS-0130",
+		Provider:   provider.AWSProvider,
+		Service:    "autoscaling",
+		ShortCode:  "enforce-http-token-imds",
+		Summary:    "aws_instance should activate session tokens for Instance Metadata Service.",
+		Impact:     "Instance metadata service can be interacted with freely",
+		Resolution: "Enable HTTP token requirement for IMDS",
+		Explanation: `
+IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.
+By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional. 
+To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.
+`,
+
+		Links: []string{
+			"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service",
+		},
+
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformEnforceHttpTokenImdsGoodExamples,
+			BadExamples:         terraformEnforceHttpTokenImdsBadExamples,
+			Links:               terraformEnforceHttpTokenImdsLinks,
+			RemediationMarkdown: terraformEnforceHttpTokenImdsRemediationMarkdown,
+		},
+		CloudFormation: &rules.EngineMetadata{
+			GoodExamples:        cloudformationEnforceHttpTokenImdsGoodExamples,
+			BadExamples:         cloudformationEnforceHttpTokenImdsBadExamples,
+			Links:               cloudformationEnforceHttpTokenImdsLinks,
+			RemediationMarkdown: cloudformationEnforceHttpTokenImdsRemediationMarkdown,
+		},
+		Severity: severity.High,
+	},
+	func(s *state.State) (results rules.Results) {
+		for _, configuration := range s.AWS.Autoscaling.LaunchConfigurations {
+			if !configuration.RequiresIMDSToken() && !configuration.HasHTTPEndpointDisabled() {
+				results.Add(
+					"Launch configuration does not require IMDS access to require a token",
+					configuration.MetadataOptions.HttpTokens,
+				)
+			} else {
+				results.AddPassed(&configuration)
+			}
+		}
+		for _, instance := range s.AWS.Autoscaling.LaunchTemplates {
+			if !instance.RequiresIMDSToken() && !instance.HasHTTPEndpointDisabled() {
+				results.Add(
+					"Launch template does not require IMDS access to require a token",
+					instance.MetadataOptions.HttpTokens,
+				)
+			} else {
+				results.AddPassed(&instance)
+			}
+		}
+		return results
+	},
+)

rules/aws/autoscaling/enforce_http_token_imds.tf.go

@@ -0,0 +1,28 @@
+package autoscaling
+
+var terraformEnforceHttpTokenImdsGoodExamples = []string{
+	`
+ resource "aws_launch_template" "good_example" {
+	 image_id      = "ami-005e54dee72cc1d00"
+	 instance_type = "t2.micro"
+	 metadata_options {
+	 http_tokens = "required"
+	 }	
+ }
+ `,
+}
+
+var terraformEnforceHttpTokenImdsBadExamples = []string{
+	`
+ resource "aws_launch_template" "bad_example" {
+	 image_id      = "ami-005e54dee72cc1d00"
+	 instance_type = "t2.micro"
+ }
+ `,
+}
+
+var terraformEnforceHttpTokenImdsLinks = []string{
+	`https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options`,
+}
+
+var terraformEnforceHttpTokenImdsRemediationMarkdown = ``