NIFCLOUD RDB has public DB ingress security group rule

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-nifcloud-db-security-group-has-public-ingress-sgr

Cloud Provider: Nifcloud

Platform: Terraform

Severity: High

Category: Networking and Firewall

Learn More

Description

A nifcloud_db_security_group ingress security group rule allows traffic from /0. The rule parses rule[].cidr_ip, splitting on / and converting the suffix to a number; it flags when that numeric mask is less than 1, indicating a CIDR of /0. This represents an overly permissive cidr range that allows traffic from any IP address.

Compliant Code Examples

resource "nifcloud_db_security_group" "negative" {
  group_name        = "example"
  availability_zone = "east-11"
  rule {
    cidr_ip = "10.0.0.0/16"
  }
}

Non-Compliant Code Examples

resource "nifcloud_db_security_group" "positive" {
  group_name        = "example"
  availability_zone = "east-11"
  rule {
    cidr_ip = "0.0.0.0/0"
  }
}