From e69d2af4ae0f66ee689c6fc45f7fe7dbb194d019 Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 18:51:35 +0100 Subject: [PATCH 1/8] Add AWS resources for S3 bucket and security group --- terraform/main.tf | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 terraform/main.tf diff --git a/terraform/main.tf b/terraform/main.tf new file mode 100644 index 0000000000..c6ad656736 --- /dev/null +++ b/terraform/main.tf @@ -0,0 +1,26 @@ +provider "aws" { + region = "eu-central-1" +} + +resource "aws_s3_bucket" "demo" { + bucket = "unzer-demo-public-bucket" +} + +resource "aws_s3_bucket_public_access_block" "demo" { + bucket = aws_s3_bucket.demo.id + block_public_acls = false + block_public_policy = false + ignore_public_acls = false + restrict_public_buckets = false +} + +resource "aws_security_group" "demo" { + name = "demo-open-sg" + + ingress { + from_port = 22 + to_port = 22 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } +} From 070ef449ef2cf31527d1f7df41abf774112370c1 Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 20:10:37 +0100 Subject: [PATCH 2/8] Rename S3 bucket to 'app-assets-eu-central-1' --- terraform/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/main.tf b/terraform/main.tf index c6ad656736..8f380cc0e5 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -3,7 +3,7 @@ provider "aws" { } resource "aws_s3_bucket" "demo" { - bucket = "unzer-demo-public-bucket" + bucket = "app-assets-eu-central-1" } resource "aws_s3_bucket_public_access_block" "demo" { From 0a861045719cd8062bf06459180009e362f3d0f4 Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 20:11:59 +0100 Subject: [PATCH 3/8] Add Snyk IaC GitHub Actions workflow --- terraform/.github/workflows/snyk-iac.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 terraform/.github/workflows/snyk-iac.yml diff --git a/terraform/.github/workflows/snyk-iac.yml b/terraform/.github/workflows/snyk-iac.yml new file mode 100644 index 0000000000..58b96e75d8 --- /dev/null +++ b/terraform/.github/workflows/snyk-iac.yml @@ -0,0 +1,15 @@ + name: Snyk IaC gate + on: + pull_request: + paths: ['terraform/**'] + + jobs: + iac: + runs-on: ubuntu-latest + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + steps: + - uses: actions/checkout@v4 + - uses: snyk/actions/setup@master + - name: Scan Terraform + run: snyk iac test terraform/ --severity-threshold=high From 1a21d378ee4689c256ec09c12f49369dc1b9655d Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 20:25:37 +0100 Subject: [PATCH 4/8] Fix formatting in snyk-iac.yml From 80d2a2796faf9e6e911c79617ba67dc9d01773f1 Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 20:36:16 +0100 Subject: [PATCH 5/8] Add Snyk IaC workflow for Terraform scans --- .github/workflows/snyk-iac.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/workflows/snyk-iac.yml diff --git a/.github/workflows/snyk-iac.yml b/.github/workflows/snyk-iac.yml new file mode 100644 index 0000000000..58b96e75d8 --- /dev/null +++ b/.github/workflows/snyk-iac.yml @@ -0,0 +1,15 @@ + name: Snyk IaC gate + on: + pull_request: + paths: ['terraform/**'] + + jobs: + iac: + runs-on: ubuntu-latest + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + steps: + - uses: actions/checkout@v4 + - uses: snyk/actions/setup@master + - name: Scan Terraform + run: snyk iac test terraform/ --severity-threshold=high From 34e11354e9fd9148dbc55477cc7b4c970f92cdfe Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 20:37:01 +0100 Subject: [PATCH 6/8] Delete terraform/.github/workflows/snyk-iac.yml --- terraform/.github/workflows/snyk-iac.yml | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 terraform/.github/workflows/snyk-iac.yml diff --git a/terraform/.github/workflows/snyk-iac.yml b/terraform/.github/workflows/snyk-iac.yml deleted file mode 100644 index 58b96e75d8..0000000000 --- a/terraform/.github/workflows/snyk-iac.yml +++ /dev/null @@ -1,15 +0,0 @@ - name: Snyk IaC gate - on: - pull_request: - paths: ['terraform/**'] - - jobs: - iac: - runs-on: ubuntu-latest - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - steps: - - uses: actions/checkout@v4 - - uses: snyk/actions/setup@master - - name: Scan Terraform - run: snyk iac test terraform/ --severity-threshold=high From ec87283b8afb8426eb9b432493411ab458fc5f39 Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 20:44:18 +0100 Subject: [PATCH 7/8] Enable public access block settings for S3 bucket --- terraform/main.tf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index 8f380cc0e5..11ac22ef9f 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,10 +8,10 @@ resource "aws_s3_bucket" "demo" { resource "aws_s3_bucket_public_access_block" "demo" { bucket = aws_s3_bucket.demo.id - block_public_acls = false - block_public_policy = false - ignore_public_acls = false - restrict_public_buckets = false + block_public_acls = true + block_public_policy = true + ignore_public_acls = true + restrict_public_buckets = true } resource "aws_security_group" "demo" { From 459e80ec77839377f41af90416112305e0728e66 Mon Sep 17 00:00:00 2001 From: Mam Date: Wed, 30 Sep 2026 20:47:04 +0100 Subject: [PATCH 8/8] Allow public access to S3 bucket --- terraform/main.tf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index 11ac22ef9f..8f380cc0e5 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,10 +8,10 @@ resource "aws_s3_bucket" "demo" { resource "aws_s3_bucket_public_access_block" "demo" { bucket = aws_s3_bucket.demo.id - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true + block_public_acls = false + block_public_policy = false + ignore_public_acls = false + restrict_public_buckets = false } resource "aws_security_group" "demo" {