Metadata

Id: terraform-nifcloud-computing-instance-has-public-ingress-sgr

Provider: Nifcloud

Platform: Terraform

Severity: High

Category: Networking and Firewall

Learn More

• Provider Reference

Description

An ingress nifcloud_security_group_rule allows traffic from a /0 CIDR. The policy detects nifcloud_security_group_rule resources whose cidr_ip is /0 (allowing traffic from anywhere) and flags them as insecure. The rule reports the following attributes: documentId, resourceType, resourceName, searchKey, issueType, keyExpectedValue, and keyActualValue.

Compliant Code Examples

resource "nifcloud_security_group_rule" "negative" {
  security_group_names = ["http"]
  type                 = "IN"
  description          = "HTTP from VPC"
  from_port            = 80
  to_port              = 80
  protocol             = "TCP"
  cidr_ip              = "10.0.0.0/16"
}

Non-Compliant Code Examples

resource "nifcloud_security_group_rule" "positive" {
  security_group_names = ["http"]
  type                 = "IN"
  description          = "HTTP from VPC"
  from_port            = 80
  to_port              = 80
  protocol             = "TCP"
  cidr_ip              = "0.0.0.0/0"
}