Feat/checkov terraform policy

[RachanaB5]

Overview

This PR introduces policy-as-code enforcement using Checkov into the Terraform workflow, ensuring that infrastructure changes are continuously validated against security best practices in CI.

In addition to integration, this PR remediates existing misconfigurations and establishes safer defaults, while preserving flexibility for honeypot-specific requirements.

Closes #25

---

Goals

• Enforce IaC security checks automatically in CI
• Reduce risk of misconfigured cloud resources
• Establish secure-by-default Terraform configurations
• Maintain flexibility for intentional insecure setups (honeypot scenarios)

---

Key Changes

1. Checkov Integration (CI + Local)

• Added .checkov.yaml:
  • Targets terraform/ directory
  • soft-fail: false ensures CI fails on policy violations
• Updated .github/workflows/terraform.yml:
  • Installs Checkov via pip
  • Runs:
    • checkov --config .checkov.yaml
    • terraform fmt
    • terraform init
    • terraform validate
• Ensures security validation runs before Terraform execution

---

2. Developer Experience (Local Validation)

• Enhanced scripts/validate.sh:
  • Runs Checkov if available in PATH
  • Falls back gracefully if not installed
  • Keeps Terraform validation independent

This allows contributors to replicate CI checks locally.

---

3. Documentation Improvements

• Added Checkov section in README.md:
  • Instructions to run scans locally
  • Explanation of # checkov:skip=...
  • Emphasis on justified exceptions only

---

Security and Infrastructure Improvements

Secure Defaults

• admin_ssh_cidr set to 127.0.0.1/32
  Prevents unintended public SSH exposure

---

EC2 Hardening

• Enabled:
  • monitoring = true
  • ebs_optimized = true
    Improves observability and performance baseline

---

VPC and Networking

• Explicitly defined aws_default_security_group
• Avoids reliance on implicit AWS defaults

---

Controlled Exceptions (Honeypot Context)

Some Checkov rules are intentionally skipped due to honeypot design:

• Public subnet exposure
• Wide egress rules
• CKV2_AWS_12

All skips are:

• Explicitly documented
• Contextually justified
• Limited to required scope

---

IAM Policy Hardening (Flow Logs)

• Scoped permissions to specific CloudWatch Log Group ARN
• Removed:
  • Wildcard "Resource": "*"
  • Unnecessary CreateLogGroup permission

Follows the principle of least privilege

---

CloudWatch Logging

• Added documented skips for:
  • Log retention less than one year
  • Missing KMS encryption

These are identified as potential future improvements

---

Impact

Before

• No automated IaC security validation
• Potentially unsafe defaults (e.g., SSH exposure)
• Over-permissive IAM policies

After

• Automated security enforcement in CI
• Safer infrastructure defaults
• Reduced attack surface
• Clear documentation of intentional risks

---

How to Test

pip install checkov
./scripts/validate.sh