aws-opsworks-contains-app-env-secret
OpsWorks App secure environment variables are credentials accessible to all deployment code on the stack.
match (record)
{
"api": "opsworks:DescribeApps",
"field": "Environment[].Secure == true",
"resource_type": "AWS::OpsWorks::App"
}
emit
| source type | ApplicationPlatform |
|---|---|
| target type | Secret |
| source | <OpsWorks Stack (ApplicationPlatform) owning the app> |
| target | <Secret (app environment variable key/value)> |
Narrative
{stack.name} app {app.name} stores a secure environment variable that is accessible as a Chef data bag entry to any deployment recipe; any code executed via opsworks:CreateDeployment can exfiltrate it.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-contains-app-env-secret
emits: ContainsSecret
description: OpsWorks App secure environment variables are credentials accessible to all deployment code
on the stack.
match_record:
resource_type: AWS::OpsWorks::App
api: opsworks:DescribeApps
field: Environment[].Secure == true
emit:
source_type: ApplicationPlatform
target_type: Secret
source: <OpsWorks Stack (ApplicationPlatform) owning the app>
target: <Secret (app environment variable key/value)>
permissions: []
evidence_field: opsworks:DescribeApps[].Apps[].Environment[]{Secure=true}
narrative: '{stack.name} app {app.name} stores a secure environment variable that is accessible as a
Chef data bag entry to any deployment recipe; any code executed via opsworks:CreateDeployment can
exfiltrate it.'