Skip to content

SECURITY_SCORECARD.md

Latest commit

 

History

History
62 lines (45 loc) · 4.61 KB

SECURITY_SCORECARD.md

File metadata and controls

62 lines (45 loc) · 4.61 KB
Raw

Generated by Merlin Studio (https://app.merlin-studio.cloud). Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0).

Security Scorecard

Score: 100/100 Grade: A+

Passed: 313 Failed: 0

Compliance Frameworks: GDPR, EUCS, NIS2

Compliance Checks

These checks are performed against your configuration intent based on the selected compliance frameworks.

01 (1/1 passed)

Check Status Severity Frameworks Reference Description
enabled_regions ✅ PASS required GDPR, EUCS, NIS2 GDPR Art 44-49 GDPR recommends EU regions for EU resident data

Security Baseline (4/4 passed)

Check Status Severity Frameworks Reference Description
cmek_log_encryption ✅ PASS required GDPR, EUCS GDPR Art 32 GDPR Article 32 encryption of personal data
cloudtrail_org_enabled ✅ PASS required EUCS, NIS2 EUCS EUCS audit controls
guardduty_enabled ✅ PASS required NIS2 NIS2 Art 21 NIS2 Art 21 - risk management measures
security_hub_enabled ✅ PASS required NIS2 NIS2 Art 21 NIS2 Art 21 - risk management measures

Advanced Security (1/1 passed)

Check Status Severity Frameworks Reference Description
macie_enabled ✅ PASS required GDPR GDPR Art 32 GDPR Article 32 sensitive data discovery

Technical Infrastructure Checks (Checkov)

Passed: 307    Failed: 0

File paths below reference the canonical Terraform (.tf) representation that Checkov scans. If your bundle ships a different output format (e.g. tfvars, LZA YAML, or CDK), the .tf files are not included — apply the fix to the field of the same name in your format's equivalent file, or change it in the wizard and re-generate.

Suppressed Checks

These Checkov findings are suppressed intentionally — the associated risk is mitigated by the architecture rather than the flagged attribute. The rationale for each is shown below (and inline in the OpenTofu .tf source).

Check Resource Rationale
CKV_AWS_274 aws_ssoadmin_managed_policy_attachment.admin_aws_managed — iam.tf:L39 Identity Center cloud-admin / break-glass / CI-apply role; defense-in-depth is org SCPs + CloudTrail alerting, not a boundary on the role itself.
CKV_AWS_274 aws_iam_role_policy_attachment.breakglassrole_administratoraccess — iam.tf:L123 Identity Center cloud-admin / break-glass / CI-apply role; defense-in-depth is org SCPs + CloudTrail alerting, not a boundary on the role itself.
CKV_AWS_274 aws_iam_role_policy_attachment.wl_terraformexecutor_administratoraccess — iam.tf:L162 Identity Center cloud-admin / break-glass / CI-apply role; defense-in-depth is org SCPs + CloudTrail alerting, not a boundary on the role itself.
CKV_AWS_109 aws_iam_policy_document.kms_default — kms.tf:L37 KMS key policy grants the account root kms:* (AWS-prescribed EnableRoot pattern, required for the key to stay manageable); principal scoping bounds the blast radius.
CKV_AWS_111 aws_iam_policy_document.kms_default — kms.tf:L37 Same as CKV_AWS_109 — kms:Update*/Schedule* on the root principal is the documented KMS baseline.
CKV_AWS_356 aws_iam_policy_document.kms_default — kms.tf:L37 Resource="*" is required at the KMS key-policy layer; principal scoping bounds the blast radius.
CKV_AWS_331 aws_ec2_transit_gateway.primary — transit_gateway.tf:L31 —
CKV_AWS_331 aws_ec2_transit_gateway.secondary — transit_gateway.tf:L73 —
CKV_TF_1 vpc_workloads — vpc.tf:L33 Module is sourced by a version-pinned registry reference, not a mutable git ref.
CKV_TF_1 vpc_shared_services — vpc.tf:L98 Module is sourced by a version-pinned registry reference, not a mutable git ref.
CKV_TF_1 vpc_hub_west — vpc.tf:L163 Module is sourced by a version-pinned registry reference, not a mutable git ref.
CKV_TF_1 vpc_workloads_west — vpc.tf:L228 Module is sourced by a version-pinned registry reference, not a mutable git ref.
CKV_AWS_18 aws_s3_bucket.central_logs — s3_log_archive.tf:L30 Access logging on the log-archive bucket is circular; CloudTrail S3 data events + SNS notifications cover this surface.
CKV_AWS_18 aws_s3_bucket.central_logs_dr — s3_log_archive.tf:L242 Access logging on the log-archive bucket is circular; CloudTrail S3 data events + SNS notifications cover this surface.