Finding
|
|
| Key |
AWS-0164:module.vpc:aws_subnet.public_zone_1 |
| Rule |
AWS-0164 — Instances in a subnet should not receive a public IP address by default. |
| Severity |
HIGH |
| Verdict author |
model |
| Instantiated at |
modules/vpc/main.tf |
| Declared at |
modules/vpc/main.tf:34 |
| Module |
module.vpc |
| Resource |
aws_subnet.public_zone_1 |
resource "aws_subnet" "public_zone_1" {
vpc_id = aws_vpc.main.id
cidr_block = var.public_subnet_cidr_block_1
availability_zone = var.az_2
map_public_ip_on_launch = true
tags = {
Name = "public"
}
}What the scanner says: Subnet associates public IP address.
Suggested resolution: Set the instance to not be publicly accessible
Verdict
real-mechanical
Rationale
modules/vpc/main.tf sets map_public_ip_on_launch = true on public_zone_1. This is redundant with today's actual behaviour: both instances placed in this subnet (live/management/main.tf:25,81) already set associate_public_ip_address = true explicitly at the instance level, which is what actually governs their public IP today, not the subnet default. The subnet flag is not a decision this architecture depends on -- it is unused given the explicit per-instance setting.
What the flag does add is a latent gap: any future resource placed in public_zone_1 without an explicit associate_public_ip_address gets a public IP by default rather than by choice. No ADR argues for that default; the architecture's public-facing design is expressed instance-by-instance (docs/adr/0002-...), not subnet-wide. Removing map_public_ip_on_launch from this resource changes no behaviour for the two instances that exist today and closes the gap for whatever is placed here next. Mechanical: delete one line, zero coordination.
Evidence
docs/adr/0002-self-host-nextcloud-on-t4g-small.md
Filed by the IaC triage pipeline under needs-triage. The verdict above is a
proposal, not a disposition: apply ready-for-agent, ready-for-human or
wontfix from docs/agents/triage-labels.md to say what happens next. The
pipeline never applies ready-for-agent itself
(openspec/changes/add-iac-security-triage/design.md — Decisions 4 and 6), and it
leaves this finding's code scanning alert open whatever the verdict says.
Finding
AWS-0164:module.vpc:aws_subnet.public_zone_1modelmodules/vpc/main.tfmodules/vpc/main.tf:34module.vpcaws_subnet.public_zone_1What the scanner says: Subnet associates public IP address.
Suggested resolution: Set the instance to not be publicly accessible
Verdict
real-mechanicalRationale
modules/vpc/main.tfsetsmap_public_ip_on_launch = trueonpublic_zone_1. This is redundant with today's actual behaviour: both instances placed in this subnet (live/management/main.tf:25,81) already setassociate_public_ip_address = trueexplicitly at the instance level, which is what actually governs their public IP today, not the subnet default. The subnet flag is not a decision this architecture depends on -- it is unused given the explicit per-instance setting.What the flag does add is a latent gap: any future resource placed in
public_zone_1without an explicitassociate_public_ip_addressgets a public IP by default rather than by choice. No ADR argues for that default; the architecture's public-facing design is expressed instance-by-instance (docs/adr/0002-...), not subnet-wide. Removingmap_public_ip_on_launchfrom this resource changes no behaviour for the two instances that exist today and closes the gap for whatever is placed here next. Mechanical: delete one line, zero coordination.Evidence
docs/adr/0002-self-host-nextcloud-on-t4g-small.mdFiled by the IaC triage pipeline under
needs-triage. The verdict above is aproposal, not a disposition: apply
ready-for-agent,ready-for-humanorwontfixfromdocs/agents/triage-labels.mdto say what happens next. Thepipeline never applies
ready-for-agentitself(
openspec/changes/add-iac-security-triage/design.md— Decisions 4 and 6), and itleaves this finding's code scanning alert open whatever the verdict says.