KEH-877 | Limit Egress Rules

[TotalDwarf03]

Overview

Trivy wants us to limit the IP addresses that the lambda can send outbound traffic to. Despite this, SPP use the same pattern as we do and would have the same issue. Since SPP has this flaw, we can add it to Trivy's ignore list.

As a precaution, and to align more closely with SPP, I have changed the egress rule to only allow HTTPS traffic.

Testing

This doesn't need testing as it runs on sdp-dev and the megalinter action passes.

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ ACTION	actionlint	2		0	0.04s
✅ DOCKERFILE	hadolint	1		0	0.13s
✅ JSON	jsonlint	1		0	0.33s
✅ JSON	prettier	1		0	0.71s
✅ JSON	v8r	1		0	1.93s
✅ MARKDOWN	markdownlint	2		0	0.53s
✅ MARKDOWN	markdown-table-formatter	2		0	0.41s
✅ REPOSITORY	checkov	yes		no	24.67s
✅ REPOSITORY	dustilock	yes		no	0.01s
✅ REPOSITORY	gitleaks	yes		no	0.23s
✅ REPOSITORY	grype	yes		no	21.78s
✅ REPOSITORY	kics	yes		no	40.67s
✅ REPOSITORY	secretlint	yes		no	0.81s
✅ REPOSITORY	syft	yes		no	2.49s
✅ REPOSITORY	trivy	yes		no	18.74s
✅ REPOSITORY	trivy-sbom	yes		no	0.2s
✅ TERRAFORM	terraform-fmt	6		0	0.44s
✅ YAML	prettier	5		0	0.77s
✅ YAML	v8r	5		0	7.03s
✅ YAML	yamllint	5		0	0.7s

See detailed report in MegaLinter reports

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

• oxsecurity/megalinter/flavors/terraform@v8.3.0 (54 linters)
• oxsecurity/megalinter/flavors/cupcake@v8.3.0 (83 linters)

MegaLinter is graciously provided by OX Security