add example module

[achiar99]

No description provided.

[bridgecrew-staging]

Bridgecrew has found infrastructure configuration errors in this PR ⬇️

[bridgecrew-staging]

  Ensure every Security Group rule has a description
    Resource: aws_security_group.sg | ID: BC_AWS_NETWORKING_31

Description

Descriptions can be up to 255 characters long and can be set and viewed from the AWS Management Console, AWS Command Line Interface (CLI), and the AWS APIs.

We recommend you add descriptive text to each of your Security Group Rules clarifying each rule's goals, this helps prevent developer errors.

Benchmarks

• ISO27001 A.10.1.1
• SOC2 CC6.3.3

[bridgecrew-staging]

  Ensure AWS Security Group does not allow all traffic on SSH port 22
    Resource: aws_security_group.sg | ID: BC_AWS_NETWORKING_1

Description

Security groups are stateful and provide filtering of ingress/egress network traffic to AWS resources. We recommend that security groups do not allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.

Benchmarks

• FEDRAMP (MODERATE) SC-7(3), SC-7, AC-4
• CIS AWS V1.3 5.2
• CIS AWS V1.2 4.1
• ISO27001 A.10.1.1
• NIST-800-53 SC-2, CM-3, CA-9, CA-3, AC-17
• HIPAA 164.312(E)(1)
• PCI-DSS V3.2 2
• PCI-DSS V3.2.1 2.2.2, 1.3, 1.2.1
• SOC2 CC6.3.3

[bridgecrew-staging]

  Ensure Security Groups are attached to EC2 instances or ENIs
    Resource: aws_security_group.sg | ID: BC_AWS_NETWORKING_51

How to Fix

resource "aws_network_interface" "test" {
  subnet_id       = "aws_subnet.public_a.id"
  security_groups = [aws_security_group.ok_sg.id]
}

resource "aws_instance" "test" {
  ami           = "data.aws_ami.ubuntu.id"
  instance_type = "t3.micro"
  security_groups = [aws_security_group.ok_sg.id]
}

resource "aws_security_group" "ok_sg" {
  ingress {
    description = "TLS from VPC"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = 0.0.0.0/0
  }
}

Description

A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.