Cfngoat is one of Bridgecrew's "Vulnerable by Design" Infrastructure as Code repositories, a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.
It's an ideal companion to testing build time Infrastructure as Code scanning tools, such as Bridgecrew & Checkov
Cfngoat was built to enable DevSecOps design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like Bridgecrew & Checkov, inline-linters, pre-commit hooks or other code scanning methods.
Cfngoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure.
aws cloudformation create-stack --stack-name cfngoat --template-body file://cfngoat.yaml --region us-east-1 --parameters ParameterKey=Password,ParameterValue=MyPassword10 --capabilities CAPABILITY_NAMED_IAMExpect provisioning to take at least 5 minutes.
Multiple stacks can be deployed simultaniously by changing the --stack-name and adding an Environment parameter:
aws cloudformation create-stack --stack-name cfngoat2 --template-body file://cfngoat.yaml --region us-east-1 --parameters ParameterKey=Password,ParameterValue=MyPassword10 ParameterKey=Environment,ParameterValue=dev2 --capabilities CAPABILITY_NAMED_IAM- Where to get help: the Bridgecrew Community Slack
Before you proceed please take a not of these warning:
⚠️ Cfngoat creates intentionally vulnerable AWS resources into your account. DO NOT deploy Cfngoat in a production environment or alongside any sensitive AWS resources.
- aws cli
- CfnGoat - Vulnerable by design Cloudformation template
- TerraGoat - Vulnerable by design Terraform stack
- CDKGoat - Vulnerable by design CDK application
Contribution is welcomed!
We would love to hear about more ideas on how to find vulnerable infrastructure-as-code design patterns.
Bridgecrew builds and maintains Cfngoat to encourage the adoption of policy-as-code.
If you need direct support you can contact us at [email protected].
Passed Checks: 73, Failed Checks: 64, Skipped Checks: 0
| Check ID | Check Name | Resource | Guideline | File |
|---|---|---|---|---|
| CKV_AWS_58 | Ensure EKS Cluster has Secrets Encryption Enabled | AWS::EKS::Cluster.EKSCluster | Link | /eks.yaml |
| CKV_AWS_46 | Ensure no hard-coded secrets exist in EC2 user data | AWS::EC2::Instance.EC2Instance | Link | /cfngoat.yaml |
| CKV_AWS_3 | Ensure all data stored in the EBS is securely encrypted | AWS::EC2::Volume.WebHostStorage | Link | /cfngoat.yaml |
| CKV_AWS_260 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | AWS::EC2::SecurityGroup.WebNodeSG | Link | /cfngoat.yaml |
| CKV_AWS_24 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | AWS::EC2::SecurityGroup.WebNodeSG | Link | /cfngoat.yaml |
| CKV_AWS_23 | Ensure every security groups rule has a description | AWS::EC2::SecurityGroup.WebNodeSG | Link | /cfngoat.yaml |
| CKV_AWS_21 | Ensure the S3 bucket has versioning enabled | AWS::S3::Bucket.FlowBucket | Link | /cfngoat.yaml |
| CKV_AWS_53 | Ensure S3 bucket has block public ACLs enabled | AWS::S3::Bucket.FlowBucket | Link | /cfngoat.yaml |
| CKV_AWS_56 | Ensure S3 bucket has RestrictPublicBuckets enabled | AWS::S3::Bucket.FlowBucket | Link | /cfngoat.yaml |
| CKV_AWS_54 | Ensure S3 bucket has block public policy enabled | AWS::S3::Bucket.FlowBucket | Link | /cfngoat.yaml |
| CKV_AWS_55 | Ensure S3 bucket has ignore public ACLs enabled | AWS::S3::Bucket.FlowBucket | Link | /cfngoat.yaml |
| CKV_AWS_18 | Ensure the S3 bucket has access logging enabled | AWS::S3::Bucket.FlowBucket | Link | /cfngoat.yaml |
| CKV_AWS_109 | Ensure IAM policies does not allow permissions management without constraints | AWS::IAM::Policy.UserPolicy | Link | /cfngoat.yaml |
| CKV_AWS_40 | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | AWS::IAM::Policy.UserPolicy | Link | /cfngoat.yaml |
| CKV_AWS_111 | Ensure IAM policies does not allow write access without constraints | AWS::IAM::Policy.UserPolicy | Link | /cfngoat.yaml |
| CKV_AWS_107 | Ensure IAM policies does not allow credentials exposure | AWS::IAM::Policy.UserPolicy | Link | /cfngoat.yaml |
| CKV_AWS_110 | Ensure IAM policies does not allow privilege escalation | AWS::IAM::Policy.UserPolicy | Link | /cfngoat.yaml |
| CKV_AWS_108 | Ensure IAM policies does not allow data exfiltration | AWS::IAM::Policy.UserPolicy | Link | /cfngoat.yaml |
| CKV_AWS_7 | Ensure rotation for customer created CMKs is enabled | AWS::KMS::Key.LogsKey | Link | /cfngoat.yaml |
| CKV_AWS_157 | Ensure that RDS instances have Multi-AZ enabled | AWS::RDS::DBInstance.DefaultDB | Link | /cfngoat.yaml |
| CKV_AWS_118 | Ensure that enhanced monitoring is enabled for Amazon RDS instances | AWS::RDS::DBInstance.DefaultDB | Link | /cfngoat.yaml |
| CKV_AWS_17 | Ensure all data stored in RDS is not publicly accessible | AWS::RDS::DBInstance.DefaultDB | Link | /cfngoat.yaml |
| CKV_AWS_16 | Ensure all data stored in the RDS is securely encrypted at rest | AWS::RDS::DBInstance.DefaultDB | Link | /cfngoat.yaml |
| CKV_AWS_23 | Ensure every security groups rule has a description | AWS::EC2::SecurityGroup.DefaultSG | Link | /cfngoat.yaml |
| CKV_AWS_363 | Ensure Lambda Runtime is not deprecated | AWS::Lambda::Function.AnalysisLambda | Link | /cfngoat.yaml |
| CKV_AWS_45 | Ensure no hard-coded secrets exist in Lambda environment | AWS::Lambda::Function.AnalysisLambda | Link | /cfngoat.yaml |
| CKV_AWS_173 | Check encryption settings for Lambda environment variable | AWS::Lambda::Function.AnalysisLambda | Link | /cfngoat.yaml |
| CKV_AWS_115 | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | AWS::Lambda::Function.AnalysisLambda | Link | /cfngoat.yaml |
| CKV_AWS_117 | Ensure that AWS Lambda function is configured inside a VPC | AWS::Lambda::Function.AnalysisLambda | Link | /cfngoat.yaml |
| CKV_AWS_116 | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | AWS::Lambda::Function.AnalysisLambda | Link | /cfngoat.yaml |
| CKV_AWS_21 | Ensure the S3 bucket has versioning enabled | AWS::S3::Bucket.DataBucket | Link | /cfngoat.yaml |
| CKV_AWS_53 | Ensure S3 bucket has block public ACLs enabled | AWS::S3::Bucket.DataBucket | Link | /cfngoat.yaml |
| CKV_AWS_20 | Ensure the S3 bucket does not allow READ permissions to everyone | AWS::S3::Bucket.DataBucket | Link | /cfngoat.yaml |
| CKV_AWS_56 | Ensure S3 bucket has RestrictPublicBuckets enabled | AWS::S3::Bucket.DataBucket | Link | /cfngoat.yaml |
| CKV_AWS_54 | Ensure S3 bucket has block public policy enabled | AWS::S3::Bucket.DataBucket | Link | /cfngoat.yaml |
| CKV_AWS_55 | Ensure S3 bucket has ignore public ACLs enabled | AWS::S3::Bucket.DataBucket | Link | /cfngoat.yaml |
| CKV_AWS_18 | Ensure the S3 bucket has access logging enabled | AWS::S3::Bucket.DataBucket | Link | /cfngoat.yaml |
| CKV_AWS_21 | Ensure the S3 bucket has versioning enabled | AWS::S3::Bucket.FinancialsBucket | Link | /cfngoat.yaml |
| CKV_AWS_53 | Ensure S3 bucket has block public ACLs enabled | AWS::S3::Bucket.FinancialsBucket | Link | /cfngoat.yaml |
| CKV_AWS_56 | Ensure S3 bucket has RestrictPublicBuckets enabled | AWS::S3::Bucket.FinancialsBucket | Link | /cfngoat.yaml |
| CKV_AWS_54 | Ensure S3 bucket has block public policy enabled | AWS::S3::Bucket.FinancialsBucket | Link | /cfngoat.yaml |
| CKV_AWS_55 | Ensure S3 bucket has ignore public ACLs enabled | AWS::S3::Bucket.FinancialsBucket | Link | /cfngoat.yaml |
| CKV_AWS_18 | Ensure the S3 bucket has access logging enabled | AWS::S3::Bucket.FinancialsBucket | Link | /cfngoat.yaml |
| CKV_AWS_53 | Ensure S3 bucket has block public ACLs enabled | AWS::S3::Bucket.OperationsBucket | Link | /cfngoat.yaml |
| CKV_AWS_56 | Ensure S3 bucket has RestrictPublicBuckets enabled | AWS::S3::Bucket.OperationsBucket | Link | /cfngoat.yaml |
| CKV_AWS_54 | Ensure S3 bucket has block public policy enabled | AWS::S3::Bucket.OperationsBucket | Link | /cfngoat.yaml |
| CKV_AWS_55 | Ensure S3 bucket has ignore public ACLs enabled | AWS::S3::Bucket.OperationsBucket | Link | /cfngoat.yaml |
| CKV_AWS_18 | Ensure the S3 bucket has access logging enabled | AWS::S3::Bucket.OperationsBucket | Link | /cfngoat.yaml |
| CKV_AWS_53 | Ensure S3 bucket has block public ACLs enabled | AWS::S3::Bucket.DataScienceBucket | Link | /cfngoat.yaml |
| CKV_AWS_56 | Ensure S3 bucket has RestrictPublicBuckets enabled | AWS::S3::Bucket.DataScienceBucket | Link | /cfngoat.yaml |
| CKV_AWS_54 | Ensure S3 bucket has block public policy enabled | AWS::S3::Bucket.DataScienceBucket | Link | /cfngoat.yaml |
| CKV_AWS_55 | Ensure S3 bucket has ignore public ACLs enabled | AWS::S3::Bucket.DataScienceBucket | Link | /cfngoat.yaml |
| CKV_AWS_53 | Ensure S3 bucket has block public ACLs enabled | AWS::S3::Bucket.LogsBucket | Link | /cfngoat.yaml |
| CKV_AWS_56 | Ensure S3 bucket has RestrictPublicBuckets enabled | AWS::S3::Bucket.LogsBucket | Link | /cfngoat.yaml |
| CKV_AWS_54 | Ensure S3 bucket has block public policy enabled | AWS::S3::Bucket.LogsBucket | Link | /cfngoat.yaml |
| CKV_AWS_55 | Ensure S3 bucket has ignore public ACLs enabled | AWS::S3::Bucket.LogsBucket | Link | /cfngoat.yaml |
| CKV_AWS_18 | Ensure the S3 bucket has access logging enabled | AWS::S3::Bucket.LogsBucket | Link | /cfngoat.yaml |
| CKV_AWS_111 | Ensure IAM policies does not allow write access without constraints | AWS::IAM::Role.CleanupRole | Link | /cfngoat.yaml |
| CKV_AWS_108 | Ensure IAM policies does not allow data exfiltration | AWS::IAM::Role.CleanupRole | Link | /cfngoat.yaml |
| CKV_AWS_363 | Ensure Lambda Runtime is not deprecated | AWS::Lambda::Function.CleanBucketFunction | Link | /cfngoat.yaml |
| CKV_AWS_115 | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | AWS::Lambda::Function.CleanBucketFunction | Link | /cfngoat.yaml |
| CKV_AWS_117 | Ensure that AWS Lambda function is configured inside a VPC | AWS::Lambda::Function.CleanBucketFunction | Link | /cfngoat.yaml |
| CKV_AWS_116 | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | AWS::Lambda::Function.CleanBucketFunction | Link | /cfngoat.yaml |
| CKV2_AWS_69 | Ensure AWS RDS database instance configured with encryption in transit | AWS::RDS::DBInstance.DefaultDB | Link | /cfngoat.yaml |
Passed Checks: 0, Failed Checks: 5, Skipped Checks: 0
| Check ID | Check Name | Resource | Guideline | File |
|---|---|---|---|---|
| CKV_SECRET_6 | Base64 High Entropy String | 2f2c160ecd7febd4a33ef4fd9c05608e77a20378 | Link | /buildspec.yaml |
| CKV_SECRET_2 | AWS Access Key | fc3f784491eba6121c3bfcc1652a2c57d27b16cb | Link | /cfngoat.yaml |
| CKV_SECRET_6 | Base64 High Entropy String | c00f1a6e4b20aa64691d50781b810756d6254b8e | Link | /cfngoat.yaml |
| CKV_SECRET_2 | AWS Access Key | 25910f981e85ca04baf359199dd0bd4a3ae738b6 | Link | /cfngoat.yaml |
| CKV_SECRET_6 | Base64 High Entropy String | d70eab08607a4d05faa2d0d6647206599e9abc65 | Link | /cfngoat.yaml |
Passed Checks: 57, Failed Checks: 3, Skipped Checks: 0
| Check ID | Check Name | Resource | Guideline | File |
|---|---|---|---|---|
| CKV2_GHA_1 | Ensure top-level permissions are not set to write-all | on(Checkov) | Link | /.github/workflows/blank.yml |
| CKV2_GHA_1 | Ensure top-level permissions are not set to write-all | on(checkov-scan) | Link | /.github/workflows/main.yaml |
| CKV2_GHA_1 | Ensure top-level permissions are not set to write-all | on(build) | Link | /.github/workflows/checkov.yaml |