Transfer server does not force secure protocols. misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_357
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule is verifying that the Transfer Server only allows secure protocols. The reason why this is crucial is because insecure protocols can be exploited to potentially access sensitive data, perform unauthorized actions, or compromise the system. Unsecure protocols are more vulnerable to cyber attacks like eavesdropping, man-in-the-middle attacks, and injection attacks. By ensuring the use of secure protocols, the network communication is encrypted and safeguarded from potential breaches. It's an important factor in maintaining the confidentiality, integrity, and availability of data and services.

How to Fix

Resource: aws_transfer_server

• Arguments: protocols

To fix this issue, you need to ensure that the given AWS Transfer Server only allows secure protocols.

The above Terraform code is secure because it configures the AWS Transfer Server to only use the SFTP protocol, which is a secure protocol. This guarantees that any data transferred will be encrypted and secured against potential eavesdropping attacks. [source,go]

resource "aws_transfer_server" "example" { endpoint_type = "VPC" endpoint_details { vpc_id = aws_vpc.example.id

subnet_ids = [ aws_subnet.example1.id, aws_subnet.example2.id, ] }

identity_provider_type = "SERVICE_MANAGED"

• protocols = ["SFTP"] logging_role = aws_iam_role.example.arn }

---